mailer[.]token2049[.]cyou

PhishDestroy identifies an active brand impersonation threat involving the domain mailer.token2049.cyou, which is specifically designed as an OKX impersonation crypto drainer. This domain is currently classified as an active threat with an under-investigation risk level. The campaign leverages social engineering tactics to trick users into divulging credentials or transferring funds under the guise of a legitimate OKX communication. PhishDestroy’s analysis reveals critical technical indicators associated with this domain. This domain was flagged by 2 of 95 VirusTotal vendors, indicating a low detection rate despite its malicious intent. It is registered through Dynadot LLC and was created on April 29, 2025. The domain resolves to the IP address 103.224.212.122 and has been blocked by MetaMask and SEAL. Additionally, this domain appears on 2 security blocklists. The SSL certificate for this domain is issued by Let's Encrypt, which may further enhance its perceived legitimacy among unsuspecting users. Trust scores for this domain remain critically low, reflecting its recent emergence and unproven status in threat intelligence repositories. The current status of this campaign is active, with no signs of immediate takedown. Users are strongly advised to exercise extreme caution when encountering communications referencing OKX, particularly those involving links to mailer.token2049.cyou. PhishDestroy recommends verifying the authenticity of any suspicious communications by cross-referencing official channels. Additionally, users should ensure their security software is updated and consider blocking this domain at the network level. For further investigation, refer to the unique seed identifier 8d9a28 as part of PhishDestroy’s threat intelligence tracking.