token[.]apple[.]insms[.]chat

PhishDestroy identifies token.apple.insms.chat as an active brand impersonation domain targeting OKX users through fraudulent token-related lures. This domain employs sophisticated social engineering tactics, mimicking Apple’s SMS notification infrastructure while promoting fake OKX token offers. No drainer kit artifacts were detected during initial triage, but the page structure suggests typical phishing workflows including fake wallet connection prompts. Investigators note the domain’s Apple-themed subdomains as a deliberate attempt to bypass user scrutiny.

Technical analysis reveals the page resolves to IP 104.21.71.98 and currently exhibits 0 detections across 95 VirusTotal scanners. The domain was registered through Cloudflare, Inc. with an SSL certificate issued by Google Trust Services, adding a veneer of legitimacy. Creation occurred recently with no available historical data suggesting opportunistic registration. While the domain remains unflagged by Google Safe Browsing, third-party threat intelligence shows zero blocklist detections. The combination of fresh registration, minimal detection coverage, and brand impersonation indicates active but low-sophistication threat activity.

This domain remains ACTIVE with risk assessment still under investigation. Security teams should block 104.21.71.98 at the network perimeter and investigate DNS queries for token.apple.insms.chat. Users are advised to verify all OKX communications through official channels and avoid interacting with SMS links claiming to originate from Apple or OKX. The current risk posture could escalate if this campaign gains traction, with potential for credential harvesting or cryptocurrency theft.