token-creator[.]fun

PhishDestroy identifies token-creator.fun as an active brand impersonation domain targeting OKX users with intent to deceive investors and steal credentials. While the 0/95 VirusTotal detection rate currently shields it from most scanners, its recent domain creation date (March 11, 2025), use of a Let’s Encrypt SSL certificate, and hosting on IP 63.176.8.218 suggest an aggressive deployment model designed to evade early detection and exploit user trust.

This domain was flagged for impersonating OKX, a major cryptocurrency exchange, and registered through Name.com, Inc. on the same day it went live. With no detections on VirusTotal as of the latest scan and no confirmed presence on public blocklists such as Google Safe Browsing or PhishTank at this time, the site exhibits characteristics typical of newly launched crypto drainer infrastructure. The use of a legitimate certificate authority adds superficial credibility, masking malicious backend scripts designed to harvest private keys or credentials upon interaction.

Users must avoid interacting with token-creator.fun and report it immediately. OKX users should access the exchange only via verified domains (okx.com or regional equivalents) using bookmarks or official apps. Cryptocurrency investors are advised to verify token creation tools independently and never input private keys or seed phrases on third-party websites. Platforms and security vendors should add this domain to blocklists and investigate associated IPs for coordinated campaigns. Always cross-check URLs before clicking.