yzytoken-drop[.]xyz

This domain, yzytoken-drop.xyz, poses a targeted brand_impersonation threat against OKX, a cryptocurrency exchange platform. The site masquerades as an official airdrop campaign titled 'YZY AIRDROP,' exploiting user interest in token distributions to harvest credentials, private keys, or install malicious wallet software. Such schemes are commonly used to drain digital asset holdings or compromise accounts through deceptive prompts for wallet connections or seed phrase submissions. The domain’s infrastructure and page content were designed to mimic legitimate OKX promotions, increasing the likelihood of successful deception among users familiar with the brand’s past or ongoing airdrop events.

Analysis of the domain reveals multiple technical indicators supporting its malicious classification. The domain was registered on August 26, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. VirusTotal detections show 3 out of 95 security vendors flagging the domain as malicious, while it appears on two independent security blocklists. The domain resolved to the IP address 104.21.24.183 and employed Cloudflare’s content delivery network, a common tactic to obscure hosting origins and evade takedowns. The SSL certificate was issued by Google Trust Services, providing a false sense of security to visitors, while the site utilized HTTP/3, a modern protocol that can complicate network-based detection efforts.

Users who visited yzytoken-drop.xyz should assume their interactions were compromised. Immediately revoke any wallet connections or permissions granted to the site. Scan local devices for malware using updated security tools, as the domain may have delivered malicious payloads. Monitor linked accounts, particularly cryptocurrency wallets and exchange profiles, for unauthorized transactions. If credentials or seed phrases were entered, transfer assets to new, secure wallets and enable multi-factor authentication where available. Report the incident to the impersonated brand’s security team to aid in broader mitigation efforts.