token-xamanwallet[.]pro

This domain, token-xamanwallet.pro, carries an elevated risk level due to its specific threat type: brand impersonation. It is designed to mimic the legitimate OKX platform, tricking users into revealing sensitive information. Although currently offline, the domain's history and technical indicators suggest it was part of a targeted phishing campaign.

PhishDestroy found that only 1 out of 95 security vendors flagged this domain on VirusTotal, indicating a low detection rate at the time of analysis. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to IP 172.67.218.112. Its creation date of May 11, 2026, suggests it was recently set up for malicious purposes. The SSL certificate was issued by Let's Encrypt (E7), which is common among both legitimate and fraudulent sites. The page title was "Cold Storage in Your Pocket | Xaman," which is unrelated to the impersonated brand OKX. It appears on 3 security blocklists, further confirming its malicious nature.

To protect against such brand impersonation threats, users should always verify the URL before entering credentials or personal data. Avoid clicking on links from unsolicited emails or messages. Enable two-factor authentication on your OKX account and use a password manager to detect lookalike domains. If you have already visited this site, change your OKX password immediately and monitor your account for suspicious activity. Report any similar domains to the OKX security team.