collab-token-verification[.]xyz

The domain collab-token-verification.xyz is a phishing site engaged in brand impersonation targeting OKX, a cryptocurrency exchange. It was designed to deceive users into believing they were interacting with a legitimate token verification service, posing an elevated risk of credential theft or fraudulent transactions. The site is currently taken offline, but it previously operated as a cryptocurrency scam without an associated drainer kit.

Technical indicators confirm the malicious nature of collab-token-verification.xyz. The domain was flagged by 1 of 95 VirusTotal security vendors, including Forcepoint ThreatSeeker, and appeared on 2 security blocklists (PhishDestroy and ScamSniffer). Registered through Web Commerce Communications Limited on October 24, 2025, it resolved to the IP address 188.114.97.3, hosted by Cloudflare in the US (AS13335). No SSL certificate was present, and the observed page title was 'Collab.Land | Command Center'. The domain used Cloudflare nameservers (david.ns.cloudflare.com and thea.ns.cloudflare.com) and received a Gridinsoft trust score of 0/100.

Users who interacted with collab-token-verification.xyz should immediately change any passwords or credentials entered on the site and enable two-factor authentication (2FA) on their accounts. For cryptocurrency-related activity, revoke any token approvals granted to unknown or suspicious addresses and consider transferring funds to a new wallet. Report the domain to OKX’s official security team and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader mitigation efforts.