canbetoken[.]com

PhishDestroy identifies the domain canbetoken.com as an active brand-impersonation threat impersonating the OKX cryptocurrency exchange brand. Intelligence shows the site is a crypto-draining operation designed to trick visitors into connecting wallets and approving malicious transactions that siphon digital assets. No drainer kit fingerprints or JavaScript payloads have been extracted yet, indicating the threat actor may be field-testing the page or hiding malicious code behind redirects. The infrastructure is minimal and appears early-stage, but the impersonation payload is already live and receiving traffic.

Technical indicators are conclusive: the domain was created on July 27, 2025; VirusTotal currently scores it 1/95 with no antivirus engines flagging the page; the domain resolves to IPv4 address 2.57.91.0 and uses a valid Let’s Encrypt SSL certificate; the registrar is HOSTINGER operations, UAB; Google Safe Browsing has not yet listed the domain; and third-party blocklist checks show zero detections. These metrics place the domain in a low-signature, high-risk window where detection is delayed but the threat remains active.

The domain remains under active investigation and should be considered high-risk until remediation actions are completed. Users attempting to resolve the page should expect block recommendations from DNS filtering services. Immediate actions include blocking the domain at the firewall and endpoint levels, adding the IP 2.57.91.0 to threat intelligence feeds, and distributing an IOC package to CERT partners to expedite global takedown. Remaining risk is assessed as MEDIUM due to the absence of antivirus detection and the likelihood of ongoing impersonation campaigns against OKX customers.