phnixtoken[.]live

This domain, phnixtoken.live, is flagged for brand impersonation targeting OKX, a cryptocurrency exchange platform. The site presents itself as a legitimate token migration portal under the title 'PHNIX — Claim & Migrate,' a tactic commonly associated with cryptocurrency drainer kits designed to siphon digital assets from unsuspecting victims. Analysis indicates the domain is engineered to exploit user trust in the OKX brand, likely through social engineering techniques such as fake airdrop claims or migration prompts to harvest credentials or private keys. Infrastructure analysis reveals the domain was registered on April 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently observed in malicious campaigns. It resolves to the IP address 216.198.79.1, which has not yet been widely flagged by security vendors. As of the latest scan, VirusTotal reports 0 detections out of 95 engines, while Gridinsoft assigns a trust score of 0/100. The domain appears on a single security blocklist, and its SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its accessibility. No detections were recorded in Google Safe Browsing databases at the time of analysis. Currently, phnixtoken.live has been taken offline, likely in response to detection by security systems such as PhishDestroy. However, the domain's recent creation date and lack of prior scrutiny suggest it may re-emerge under a different name or infrastructure. Users who interacted with the site are advised to revoke any connected wallet permissions, monitor for unauthorized transactions, and verify all future communications through official OKX channels. The risk of asset compromise remains elevated for individuals who engaged with the fraudulent migration prompts, and affected parties should treat all credentials exposed to the domain as compromised.