app[.]usesendtokens[.]xyz

This domain, app.usesendtokens.xyz, has been identified as a high-risk brand impersonation targeting the cryptocurrency exchange OKX. The domain resolves to the IP address 104.21.92.33, which is located in the United States and is part of Cloudflare's network (AS13335). The domain was created on April 03, 2026, and is registered through Name.com, Inc. Analysis of the domain's infrastructure reveals that it uses Cloudflare's nameservers, irma.ns.cloudflare.com and rohin.ns.cloudflare.com, indicating a possible use of Cloudflare's services to obscure the true nature of the site. The page title, 'Sendtokens: The Wallet with Super Powers,' suggests that the attackers are attempting to lure victims into believing that the site offers enhanced cryptocurrency wallet functionalities, which is a common tactic in crypto drainer scams. While the site returns an HTTP status code of 200, indicating it is operational, it has been flagged by PhishDestroy and appears on one security blocklist. Additionally, 2 out of 95 security vendors on VirusTotal have flagged this domain, which is a concerning indicator of its potential malicious intent. Defenders should take immediate action to block access to this domain and educate users about the risks associated with visiting sites that impersonate trusted brands. It is advisable to monitor for any attempts by this domain to spread through phishing emails or social media, and to ensure that network traffic to and from this domain is blocked to prevent potential data theft or crypto asset draining. Users should verify any communications claiming to be from OKX through official channels and avoid clicking on links from untrusted sources.