grokiustoken[.]lat

grokiustoken.lat has been identified as a confirmed brand impersonation phishing site targeting the OKX cryptocurrency exchange. This domain is currently offline, but its recent registration and suspicious characteristics indicate a deliberate attempt to deceive users. The site used a Cloudflare-protected landing page with the generic title "Just a moment..." and an SSL certificate issued by Let's Encrypt, further obscuring its malicious intent.

According to security intelligence, this domain was created on February 21, 2026, and registered through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to IP address 188.114.97.3 and is listed on three security blocklists. VirusTotal flagged it as malicious with 2 out of 95 security vendors marking it as dangerous, while its trust score remains critically low. These indicators strongly suggest the domain was set up solely for phishing operations.

Despite being taken offline, users should remain vigilant as similar domains may appear. PhishDestroy recommends avoiding any interaction with grokiustoken.lat and never entering credentials or personal information on sites that impersonate OKX. Always verify URLs directly through official channels and report any suspicious domains to security teams. Check the full report for additional indicators and recommendations.