aiflow-token[.]entry-cryptolist[.]app

The domain aiflow-token.entry-cryptolist.app has been identified as an active brand impersonation threat targeting OKX users, currently under investigation with a status marked as active. This domain mimics the official OKX platform to deceive victims into connecting cryptocurrency wallets, with the intent of draining funds under the guise of legitimate token offers or transactions.
PhishDestroy analysis reveals this domain was flagged by 11 of 95 VirusTotal vendors at the time of detection, indicating it remains undetected by mainstream antivirus engines. The domain resolves to IP address 188.114.97.3 and is secured with an SSL certificate issued by Google Trust Services. Despite its low detection rate, this domain is not yet listed on any major blocklists, and its creation date, registrar details, and trust scores remain unverified or unremarkable in public records. The lack of vendor detections suggests a potentially emerging or stealthily operated threat.
Users are strongly advised to avoid interacting with aiflow-token.entry-cryptolist.app or any subdomains under entry-cryptolist.app until further notice. To mitigate risks, verify the legitimacy of cryptocurrency-related domains by cross-referencing official OKX communications and using tools like PhishDestroy for real-time threat validation. Additionally, users should enable wallet protections, such as limiting transaction approvals, and report suspicious domains to relevant cybersecurity authorities or the targeted brand’s fraud teams.