darictoken-rlusd[.]com

PhishDestroy analysts have investigated darictoken-rlusd.com, a domain engaged in brand impersonation targeting the cryptocurrency exchange OKX. The site was created on June 15, 2026, and is currently offline, but while active it masqueraded as a legitimate priority allocation program for Ripple's RLUSD stablecoin, leveraging the Daric × Ripple partnership branding. This domain posed a high risk to users who might have been lured into connecting their wallets or providing sensitive credentials under the false promise of early access to RLUSD tokens.

Technical examination reveals that the domain resolves to IP address 104.21.4.238 and is secured with an SSL certificate issued by Google Trust Services (WE1). It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with malicious domains. VirusTotal data shows that 16 out of 95 security vendors flagged this domain as malicious, and it appears on 2 security blocklists. Google Safe Browsing has also flagged it for phishing activity. These indicators confirm the domain's intent to deceive users and harvest credentials or funds.

Although the domain has been taken offline, the risk remains significant as similar domains may reappear. Users are strongly advised to avoid any unsolicited offers or links related to RLUSD allocation programs, especially those urging immediate action. Always verify the authenticity of such programs by visiting official OKX channels directly. PhishDestroy recommends reporting any suspicious domains to security teams and maintaining robust phishing awareness training to recognize brand impersonation tactics.