amazontoken[.]co

PhishDestroy identifies amazontoken.co as an active brand-impersonation scam targeting OKX users. This site mimics the official OKX exchange to trick victims into revealing login credentials and enabling fund theft. The domain was registered through GoDaddy.com, LLC on November 24, 2025 and currently resolves to IP address 192.124.249.40. VirusTotal scanning shows zero detections at this time, highlighting the need for rapid public exposure before antivirus signatures catch up. This domain poses a high immediate risk because it directly impersonates a major cryptocurrency exchange. Fake OKX login pages harvest usernames, passwords, and two-factor codes, which attackers then use to drain exchange accounts. The threat is amplified by the domain’s recent creation date—just weeks old—combined with zero VirusTotal detections as of today. Registrar data confirms GoDaddy hosting, and the SSL certificate issued by GoDaddy.com, Inc. adds superficial legitimacy while masking criminal intent. If you visited amazontoken.co, immediately change your OKX password using a different device, enable hardware 2FA, and revoke any connected API keys. Check your account for unauthorized withdrawals or trades. Report the site to OKX via official channels and scan your device with up-to-date antivirus software. Avoid entering any credentials on this domain. Forward suspicious links to OKX’s verified fraud reporting address and warn others in crypto communities to prevent further victimization.