trojantoken[.]live

This domain, trojantoken.live, poses a high-risk threat as a brand impersonation phishing site targeting users of the cryptocurrency exchange OKX. The site is designed to mimic legitimate OKX login or transaction pages, tricking victims into entering sensitive credentials, private keys, or two-factor authentication codes. Once obtained, these details are used to drain digital wallets or gain unauthorized access to user accounts. The domain employs social engineering tactics, often promoted through malicious ads, compromised social media accounts, or phishing emails, to lure victims into interacting with it. Analysis indicates trojantoken.live was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious domain registrations. The domain resolves to the IP address 188.114.96.3, hosted on Cloudflare’s infrastructure (AS13335), which is commonly used to obfuscate the true origin of phishing sites. Notably, the domain lacks an SSL certificate, a red flag for users accustomed to secure connections. It is flagged by 11 out of 95 security vendors on VirusTotal and appears on three independent security blocklists, including those maintained by cryptocurrency-focused threat intelligence sources. The domain’s current status is offline, but similar sites often reappear under different names or IP addresses. Users who visited trojantoken.live should assume their credentials or private keys may have been compromised. Immediate actions include revoking access to any connected wallets or accounts, enabling new two-factor authentication methods, and monitoring for unauthorized transactions. If financial assets were transferred, report the incident to the targeted platform (OKX) and relevant law enforcement or cybercrime units. Additionally, scan local devices for malware, as phishing sites often deploy malicious scripts or payloads. Future vigilance is critical: verify domain authenticity by cross-checking URLs with official sources, avoid clicking on unsolicited links, and use browser-based or hardware security tools to block known malicious domains.