medusa-token[.]ai-cryptolist[.]net

The domain medusa-token.ai-cryptolist.net is flagged for brand impersonation, specifically targeting the cryptocurrency exchange OKX. It was identified as part of a campaign to deceive users into divulging sensitive information or interacting with malicious content. No specific drainer kit has been identified, but the domain's infrastructure and behavior suggest it was designed to mimic the legitimate OKX website, thereby increasing the likelihood of user deception.

Infrastructure analysis reveals that the domain has been flagged by 17 out of 95 security vendors on VirusTotal, indicating a moderate level of consensus regarding its malicious nature. It is registered through Key-Systems GmbH, a domain registrar known for its use in various phishing campaigns. The domain resolves to the IP address 172.67.198.248, which has also been associated with other suspicious activities. The domain was created on April 11, 2026, and its Gridinsoft trust score is 0/100, reflecting a complete lack of trustworthiness. Additionally, the domain appears on two security blocklists, further corroborating its malicious intent.

The domain is currently offline, which reduces the immediate risk to users. However, the infrastructure and historical data indicate that the threat actors may attempt to revive the domain or use similar tactics in the future. Security teams should monitor for any reactivation and continue to educate users about the risks of visiting unverified websites, especially those impersonating well-known brands. The remaining risk is considered elevated, and it is recommended that affected users change their passwords and enable multi-factor authentication on their OKX accounts.