maxidogetoken[.]vip

PhishDestroy has identified an active brand impersonation domain, maxidogetoken.vip, designed to deceive users by mimicking the legitimate OKX cryptocurrency exchange. The domain is part of a suspected token drainer campaign targeting unsuspecting victims through fraudulent OKX token distribution schemes. This threat leverages the trust associated with OKX to trick users into connecting their wallets or revealing sensitive credentials, potentially leading to financial loss. The infrastructure behind this operation suggests a coordinated effort to exploit the OKX brand for illicit gains.

Technical analysis reveals critical indicators for this threat. The domain was registered on March 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to the IP address 104.21.42.229. The domain currently holds a VirusTotal detection score of 4/95, indicating it remains undetected by most antivirus engines. A Let's Encrypt SSL certificate has been issued to the domain, further enhancing its legitimacy in the eyes of potential victims. As of the latest assessment, the domain has not been flagged by Google Safe Browsing (GSB) and remains unblocked by major threat intelligence platforms.

The current status of this threat is classified as active and under investigation, with a unique seed identifier b9a944 assigned for tracking. PhishDestroy recommends immediate caution when encountering this domain or any associated links. Users are advised to verify the authenticity of cryptocurrency-related domains by cross-referencing with official OKX communications and to avoid interacting with unsolicited token offers. While the immediate risk is elevated due to the domain's undetected status, ongoing monitoring and collaborative threat intelligence sharing are essential to mitigate potential damage. Remaining risk includes the possibility of further exploitation by threat actors and the spread of this domain through phishing campaigns.