spxtoken[.]xyz

The domain spxtoken.xyz, which impersonates the cryptocurrency exchange OKX, has been flagged as malicious by 2 out of 92 vendors on VirusTotal. Despite its current offline status, the domain was detected by PhishDestroy on the same day it was created, May 9, 2026. This rapid detection highlights the effectiveness of PhishDestroy's ability to identify threats in the critical window before many antivirus databases update.

The phishing site was designed to deceive users into believing it was a legitimate OKX migration and claim portal, as indicated by its page title, "SPX6900 — Migration & Claim Portal." This type of impersonation scam aims to exploit users' trust in the OKX brand to steal sensitive information or cryptocurrency assets. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and hosted on an IP address managed by Lefkoff Industries in the United States.

Although the domain is now offline, its initial detection and subsequent listing on public blocklists underscore the importance of early threat identification. The domain's SSL certificate was issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its ease of access and cost-free nature. With a platform risk score of 71 out of 100, spxtoken.xyz represented a significant threat during its brief period of activity.