aerotoken[.]live

The domain aerotoken.live is actively engaged in brand impersonation, specifically targeting the cryptocurrency exchange OKX. This impersonation is designed to deceive users into believing they are interacting with a legitimate OKX service, potentially leading to the disclosure of sensitive information or financial loss.

Analysis indicates that aerotoken.live was registered on June 20, 2026, and is currently hosted on an IP address (64.29.17.65) located in the United States, which is part of the Amazon.com, Inc. network (AS16509). The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar that has been associated with other suspicious activities. Out of 95 security vendors on VirusTotal, one has flagged this domain as potentially malicious. Additionally, the domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The use of a Let's Encrypt SSL certificate, issued in 2026, does not necessarily indicate legitimacy, as it is a widely used and free service that can be easily obtained by malicious actors.

Users who have visited aerotoken.live are advised to take immediate steps to protect their personal and financial information. They should change any passwords or credentials used on the site, especially those associated with OKX or other sensitive accounts. Users are also recommended to monitor their account statements for any unusual activity and to report the incident to OKX's customer support. It is crucial to verify the authenticity of any communication or links related to OKX by visiting the official website directly or using verified contact methods.