xptoken[.]live

The domain xptoken.live has been identified as a brand impersonation threat specifically targeting OKX, a cryptocurrency exchange platform. This domain is currently offline, but prior activity indicates malicious intent to deceive users into engaging with fraudulent services. Analysis confirms the domain was designed to mimic legitimate OKX operations, likely to facilitate unauthorized transactions or data harvesting. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 09, 2026, and resolves to the IP address 64.29.17.1. Security vendors flagged this domain in 3 of 95 VirusTotal scans, while it appears on 3 distinct security blocklists. The domain's SSL certificate is issued by Let's Encrypt, a common but not exclusive indicator of legitimacy. Additional threat intelligence sources, including AlienVault OTX, have recorded this domain in 2 pulses, further corroborating its malicious classification. The Gridinsoft trust score for this domain is 0/100, reinforcing its high-risk status. Current status indicates the domain has been taken offline, reducing immediate exposure risk. However, organizations and users are advised to block the domain at the network level and monitor for any re-emergence under similar naming conventions. Security teams should update detection rules to include the domain, its resolved IP, and associated SSL certificate details. Users who may have interacted with this domain should verify account integrity, revoke any unauthorized access, and report suspicious transactions to the legitimate platform.