kishutoken[.]live

This domain, kishutoken.live, is flagged as a brand_impersonation threat specifically targeting OKX, a major cryptocurrency exchange platform. The site masquerades as a "Kishu Inu — Claim Portal," a tactic commonly employed by phishing operations to deceive users into interacting with fraudulent token claim interfaces. While no explicit drainer kit signatures were detected in the initial scan, the combination of crypto-js library usage and the claim portal theme strongly suggests an intent to harvest wallet credentials or private keys. The domain's infrastructure and naming convention further align with known cryptocurrency-themed phishing campaigns, particularly those impersonating established exchanges to exploit user trust. Analysis indicates the domain was registered on May 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk or fraudulent domains due to its lenient registration policies. The domain resolves to the IP address 216.198.79.1, which has been previously linked to other phishing and scam operations. VirusTotal detection metrics show 5 out of 95 security vendors flagging kishutoken.live as malicious, while it appears on 2 independent security blocklists. The domain's SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its free and automated issuance process. Technologies detected include Vercel for hosting, Cloudflare for content delivery and security, and HSTS implementation, which may be used to lend an air of legitimacy to the fraudulent site. As of the latest assessment, kishutoken.live has been taken offline, likely in response to detection by security vendors such as PhishDestroy and ScamSniffer. However, the elevated risk level persists due to the domain's recent registration and the potential for threat actors to re-deploy the infrastructure under a different domain or IP address. Users who may have interacted with the site are advised to immediately revoke any connected wallet permissions, transfer assets to a secure wallet, and monitor accounts for unauthorized transactions. Organizations should update their blocklists to include this domain and its associated IP address, while remaining vigilant for similar impersonation attempts targeting cryptocurrency platforms. The use of offshore registrars and bulletproof hosting providers underscores the need for proactive monitoring of newly registered domains with cryptocurrency-related keywords.