amltoken-bot[.]org

PhishDestroy identifies active brand impersonation phishing targeting OKX users via the malicious domain amltoken-bot.org. This site masquerades as an official OKX compliance bot, luring victims with promises of automated AML checks to steal credentials and assets. The domain resolves to IP 188.114.97.3 and uses a Let's Encrypt SSL certificate to appear legitimate, but was registered only on May 11, 2026 through CNOBIN INFORMATION TECHNOLOGY LIMITED. With zero detections on VirusTotal out of 95 engines, this threat remains undetected by most scanners. This domain was flagged by PhishDestroy as a high-risk impersonation campaign leveraging OKX branding. It was created May 11, 2026 and remains under investigation despite flying under the radar with no current blocklist presence. The threat actor registered the domain through a shell entity in China and configured it with modern infrastructure (Let's Encrypt SSL) to evade initial detection. Its sole purpose is to trick users into entering OKX login details or downloading malicious software. If you visited amltoken-bot.org DO NOT enter any credentials or download files. Log out of OKX immediately, clear browser cache, and run a full antivirus scan. Disconnect from the internet if you entered sensitive data and enable two-factor authentication on your OKX account. Report the domain to PhishDestroy or your security team with the unique seed 17f918 for tracking. Disable browser extensions temporarily as some may be compromised. Monitor financial accounts closely and consider resetting passwords using a clean device.