ondotokenization[.]com

This domain, ondotokenization.com, represents a high-severity brand impersonation threat specifically targeting users of the OKX cryptocurrency exchange platform. Analysis indicates the domain was engineered to mimic legitimate OKX authentication or tokenization portals, likely with the intent to harvest user credentials, private keys, or multi-factor authentication codes. The infrastructure was designed to deceive victims into entering sensitive account information under the false pretense of security verification, token migration, or platform updates, which are common pretexts in cryptocurrency phishing campaigns. Infrastructure analysis reveals the domain was registered on May 12, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-volume domain registrations used in phishing operations. The domain resolves to the IP address 104.21.72.164, located in Canada and associated with Cloudflare, Inc., a content delivery network often exploited to mask the true origin of malicious infrastructure. Detection metrics confirm the domain was flagged by 10 out of 95 security vendors on VirusTotal, indicating moderate to high confidence in its malicious classification. Additionally, the domain appears on three distinct security blocklists, further corroborating its role in fraudulent activity. The SSL certificate, issued by Let's Encrypt (serial number E7), provides minimal assurance, as such certificates are routinely used in both legitimate and malicious contexts. Users who visited ondotokenization.com or interacted with any content hosted on this domain should immediately revoke any active sessions on the legitimate OKX platform and reset their account credentials, including passwords and API keys. Multi-factor authentication tokens used on the site should be considered compromised and replaced. Affected individuals are advised to monitor their accounts for unauthorized transactions and report any suspicious activity to the legitimate platform’s security team. Given the high-risk nature of this campaign, users should also scan their devices for malware, as credential harvesting sites often deploy additional payloads to maintain persistence or exfiltrate further data.