web3[.]0tokenize[.]xyz

PhishDestroy identifies web3.0tokenize.xyz as a brand impersonation domain targeting OKX users, currently active and under investigation. The domain leverages the recognizable OKX brand to deceive visitors into disclosing credentials or transferring cryptocurrency assets under false pretenses. Initial analysis confirms the threat type as brand impersonation with a risk level classified as under_investigation.

This domain was flagged by 3 of 95 VirusTotal vendors as of the latest scan, indicating it has not yet been widely detected by security solutions. It is registered through NameSilo, LLC and resolves to IP address 74.211.109.122. The domain was created on September 27, 2025, and operates under a Let's Encrypt SSL certificate, which may lend an air of legitimacy to unsuspecting users. Despite its recent creation, the domain remains unblocked by major threat intelligence platforms, posing a potential risk for early-stage phishing campaigns targeting cryptocurrency users.

As of current findings, web3.0tokenize.xyz remains active and poses a credible threat to individuals interacting with OKX or Web3-related services. Users are advised to avoid visiting or engaging with the domain until further investigation concludes. Security teams should monitor this domain for emerging detections and consider blocking the associated IP (74.211.109.122) and registrar (NameSilo, LLC) at the network level. Additionally, users should verify URLs carefully, enable multi-factor authentication (MFA) on OKX accounts, and report suspicious activity to prevent credential theft or unauthorized fund transfers. Further updates will be provided as the investigation progresses.