solidum-rwa-token[.]next-cryptolist[.]net

This domain, solidum-rwa-token.next-cryptolist.net, is flagged as an active brand impersonation threat targeting OKX, a major cryptocurrency exchange. Analysis indicates the site is designed to mimic legitimate OKX infrastructure, likely to facilitate fraudulent token distributions or credential harvesting. No direct evidence of a crypto drainer kit has been identified, but the domain's structure and naming convention suggest an intent to exploit users expecting OKX-related services. Infrastructure analysis reveals the following technical indicators: the domain was registered on April 11, 2026, through Key-Systems GmbH and currently resolves to IP address 172.67.181.166, hosted behind Cloudflare with HTTP/3 support. The SSL certificate is issued by Google Trust Services. Security telemetry shows the domain is flagged by 18 out of 95 vendors on VirusTotal and appears on two blocklists, including PhishDestroy and OISD. Google Safe Browsing status is not explicitly listed, but the domain's inclusion on multiple blocklists suggests elevated risk. The domain remains active as of this report, with no takedown or sinkholing observed. Users are advised to treat any interaction with solidum-rwa-token.next-cryptolist.net as malicious. Organizations should update blocklists to include this domain and its resolving IP, while individuals should verify URLs through official OKX channels before engaging with token-related promotions. The elevated risk level is justified by the domain's impersonation tactics and cross-vendor detection, despite the absence of confirmed crypto drainer functionality.