safemindtoken[.]pages[.]dev

PhishDestroy identifies an active brand impersonation campaign targeting OKX users via the domain safemindtoken.pages.dev. This domain is currently hosting a crypto drainer designed to steal digital assets by tricking users into connecting their wallets to a fraudulent service. The campaign remains under active investigation and is classified as an elevated threat due to its direct impersonation of a major cryptocurrency exchange. All users are advised to exercise extreme caution when interacting with this domain or any associated links. This domain resolves to IP 172.66.47.75 and was registered through Cloudflare, Inc. PhishDestroy’s analysis indicates the domain currently shows zero detections out of 95 VirusTotal vendors, with an SSL certificate issued by Google Trust Services. It operates under Cloudflare’s Pages.dev platform, leveraging subdomain-based obfuscation to bypass traditional blocklists. No public blocklist entries have been recorded for this domain at the time of analysis, and no prior reputation scores are available due to its recent deployment. As of the latest assessment, safemindtoken.pages.dev remains active and unblocked by major security vendors. Users should avoid accessing the domain or any affiliated links. PhishDestroy recommends verifying any unexpected OKX-related communications via official channels and reporting suspicious activity immediately. Organizations are encouraged to monitor network traffic for connections to 172.66.47.75 and to update firewall rules to block access. Users who may have interacted with this domain should revoke any connected wallet permissions and conduct a full security audit of their crypto assets and accounts.