xtokenweb[.]app

This domain, xtokenweb.app, is identified as a brand impersonation threat targeting OKX, a cryptocurrency exchange platform. The site presents itself as a legitimate crypto wallet under the page title 'CryptoWallet,' likely designed to deceive users into entering sensitive credentials or transferring digital assets. Such impersonation schemes often lead to unauthorized access to accounts, financial theft, or installation of malicious software, particularly crypto drainers that automatically siphon funds from connected wallets. Analysis indicates the domain was registered on April 22, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Despite its malicious intent, the domain currently shows 0 detections out of 95 security engines on VirusTotal, suggesting it may still evade automated detection systems. Infrastructure analysis reveals it resolves to the IP address 188.114.97.3 and uses a Let's Encrypt SSL certificate, which provides encryption but does not validate legitimacy. The domain appears on three security blocklists and is actively blocked by MetaMask, PhishDestroy, and SEAL, further confirming its malicious classification. If you have visited xtokenweb.app or interacted with its content, immediate action is required. Disconnect any wallets or accounts linked to the site and revoke permissions for connected dApps. Scan your device for malware using updated security tools, as the site may have deployed malicious scripts. Monitor your cryptocurrency wallets and exchange accounts for unauthorized transactions, and consider transferring assets to a new, secure wallet if compromise is suspected. Report the domain to relevant security platforms to contribute to threat intelligence and prevent further victimization.