token-dapp[.]xyz

This domain, token-dapp.xyz, is flagged as a brand impersonation phishing site designed to deceive users of the OKX cryptocurrency exchange. The site mimics legitimate OKX login or wallet interfaces to harvest credentials, private keys, or other sensitive authentication details. Users tricked into interacting with this domain risk unauthorized access to their digital assets, financial theft, or complete account compromise. The threat is particularly elevated for individuals expecting OKX-related communications or promotions, as the domain name incorporates terms commonly associated with decentralized applications (dApps) and token services. Analysis indicates this domain was registered on October 21, 2025, through NiceNIC International Group Co., Limited, a registrar frequently observed in phishing campaigns. The domain is hosted on Cloudflare infrastructure (IP 104.21.15.39, AS13335) and secured with a Let's Encrypt SSL certificate (serial E7), a common tactic to appear legitimate. At the time of detection, 9 out of 95 security vendors on VirusTotal flagged token-dapp.xyz as malicious, with one active security blocklist listing. The page title 'Just a moment...' suggests the use of Cloudflare protection or a placeholder page, often employed to evade automated detection while the phishing kit remains accessible to targeted victims. If you visited token-dapp.xyz or entered any credentials, immediate action is required. First, revoke any active sessions or authorizations linked to the site in your OKX account settings. Reset your OKX password and enable multi-factor authentication if not already active. Monitor your account for unauthorized transactions and review connected wallet approvals for suspicious smart contract interactions. If private keys or recovery phrases were exposed, transfer assets to a new, secure wallet. Report the incident to OKX support and consider filing a complaint with your local cybercrime authority. Users should also check browser extensions or applications installed during the visit, as phishing sites often deploy malware under the guise of legitimate software.