deltafi[.]degentoken[.]vip

The domain deltafi.degentoken.vip is a brand impersonation threat targeting OKX, a well-known cryptocurrency exchange platform. The domain is currently offline, reducing the immediate risk to users. However, the history and technical indicators suggest a significant threat level.

Analysis indicates that this domain was created on May 17, 2026, and is registered through NAMECHEAP INC. The domain resolves to the IP address 172.67.186.103. It has been flagged by 4 out of 95 security vendors on VirusTotal, indicating a potential malicious intent. The domain appears on 1 security blocklist and was specifically blocked by PhishDestroy. The page title found for this domain is 'DeltaAI | Airdrop', which is a common tactic used to lure users into interacting with the site by promising attractive incentives.

Given the current offline status, the immediate threat to users is mitigated. However, it is crucial to remain vigilant as the domain could be reactivated. Security teams are advised to monitor the registration and IP address for any signs of reactivation. Users are advised to avoid clicking on links or entering personal information on any site that does not directly resolve to a known and trusted OKX domain. Additionally, organizations should update their security policies and training to include this domain in their threat awareness programs.