v1[.]token2049[.]cyou

PhishDestroy identifies v1.token2049.cyou as an active brand impersonation domain designed to mimic OKX, a leading cryptocurrency exchange. This domain is currently under investigation due to its malicious intent, specifically targeting users with a crypto drainer scheme. The site leverages the trusted reputation of OKX to deceive visitors into connecting their wallets or entering sensitive credentials, risking fund theft. This domain was flagged by 4 of 95 VirusTotal vendors, indicating it has not yet been widely recognized as malicious despite its presence on two security blocklists. It was registered through Dynadot LLC on April 29, 2025, and resolves to the IP address 103.224.212.122. The domain uses a Let's Encrypt SSL certificate to appear legitimate, and it is currently blocked by MetaMask and SEAL, though its low detection rate suggests ongoing exposure for unaware users. While the threat level is marked as 'under_investigation,' users should exercise extreme caution. PhishDestroy advises verifying the authenticity of any OKX-related link or website before interaction. Avoid clicking suspicious links, and always cross-check domains against PhishDestroy’s database. If you encounter this domain, report it immediately to enhance collective security.