os-xlayer[.]com

This domain, os-xlayer.com, is actively engaged in brand impersonation targeting OKX, a major cryptocurrency exchange platform. The phishing site presents itself as an official portal for X Layer, an EVM Layer 2 solution associated with OKX, using the page title 'X Layer | EVM Layer 2｜OKB | OKX Wallet.' The threat type aligns with brand impersonation, likely intended to deceive users into interacting with fraudulent wallet or transaction interfaces, potentially leading to unauthorized asset transfers or credential harvesting.

Infrastructure analysis reveals the domain was registered on May 28, 2024, through Global Domain Group LLC, a registrar frequently observed in malicious campaigns. It resolves to the IP address 172.67.158.158, hosted on Cloudflare’s network (AS13335) in the United States. Detection metrics indicate limited but concerning visibility: VirusTotal reports 1 out of 95 security vendors flagging the domain as malicious. The domain appears on three independent security blocklists, including PhishDestroy and MetaMask’s threat intelligence feeds. The SSL certificate is issued by Let’s Encrypt (serial number E7), a common tactic to lend superficial legitimacy to phishing sites.

As of the latest assessment, os-xlayer.com remains active and unresolved, posing a persistent risk to users. No takedown actions have been observed, and the domain continues to resolve to its Cloudflare-hosted endpoint. The combination of brand impersonation, low initial detection rates, and use of bulletproof infrastructure suggests a calculated effort to evade automated defenses. Users are advised to verify domain authenticity via official channels, avoid interacting with unsolicited wallet prompts, and cross-reference URLs against known blocklists before engaging with cryptocurrency-related platforms.