railway-token[.]web[.]app

This domain, railway-token.web.app, poses a high-risk brand impersonation threat targeting users of the OKX cryptocurrency exchange platform. Analysis indicates the site mimics a legitimate decentralized finance (DeFi) wallet interface, presenting itself as 'Railway: Private DeFi Wallet' to deceive visitors into disclosing sensitive credentials, private keys, or authorizing fraudulent transactions. The infrastructure is designed to exploit trust in established brands, potentially leading to unauthorized asset transfers or account takeovers. Infrastructure analysis reveals the domain resolves to IP address 199.36.158.100, hosted on AS54113 (Fastly, Inc.) in the United States. It is registered through Google LLC, with an SSL certificate issued by Google Trust Services (WR4). The domain appears on three security blocklists, including PhishDestroy and MetaMask, and is flagged by 1 of 95 security vendors on VirusTotal. Despite these detections, the domain remains active, increasing exposure risk to unsuspecting users. Users who visited railway-token.web.app should immediately revoke any wallet permissions or session authorizations linked to the site. All credentials or private keys entered on the page must be considered compromised and replaced. Monitor connected accounts for unauthorized transactions and report the domain to relevant security teams for further mitigation. If financial loss occurred, contact the targeted platform's support team with transaction details for potential recovery actions.