spxtoken[.]live

The domain spxtoken.live, now offline, impersonates the cryptocurrency exchange OKX. It was detected as a scam with a specific focus on misleading users through a fake migration and claim portal titled "SPX6900 — Migration & Claim Portal." This domain was flagged by one out of 91 vendors on VirusTotal and appears on public blocklists from PhishDestroy, MetaMask, and SEAL.

Registered with NICENIC INTERNATIONAL GROUP CO., LIMITED, spxtoken.live was hosted on an IP address under Amazon's infrastructure in the US. The SSL certificate was issued by Google Trust Services, which is often seen in legitimate contexts, adding a deceptive layer of authenticity to the fraudulent site. Despite its brief online presence, the site achieved a high platform risk score of 88 out of 100, indicating a significant threat level.

PhishDestroy identified this domain on June 20, 2026, just two days after its creation. The swift detection underscores the efficiency of PhishDestroy's threat intelligence pipeline, which captures threats early, often before they propagate through antivirus databases. This proactive approach helps mitigate the risk from newly registered domains designed to exploit the typical 24-72 hour gap before such domains appear in broader security databases.

The takedown of spxtoken.live reduces immediate risk, but its existence highlights ongoing threats in the cryptocurrency space. Users and organizations must remain alert to similar scams that exploit trusted brand names like OKX to deceive and defraud. The rapid emergence and subsequent deactivation of such domains illustrate the dynamic nature of phishing threats in the digital landscape.