extsy-token[.]live

The domain extsy-token.live is a high-risk phishing site engaged in brand impersonation targeting OKX, a cryptocurrency exchange. This scam domain was designed to deceive users into believing they were interacting with the legitimate OKX platform, likely to steal cryptocurrency or sensitive login credentials. As of the latest verification, extsy-token.live has been taken offline, though it previously posed a significant threat as a cryptocurrency scam.

Technical indicators confirm the malicious nature of extsy-token.live. The domain was flagged by 14 of 95 security vendors on VirusTotal, including alphaMountain.ai, BitDefender, and CyRadar. It appeared on 4 security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. Registered through Global Domain Group LLC on December 15, 2025, the domain resolved to the IP address 104.21.74.180, hosted by Cloudflare in the US. No SSL certificate was issued, and the domain was detected in 3 AlienVault OTX threat intelligence pulses. The Gridinsoft trust score for extsy-token.live was 0 out of 100, further indicating its fraudulent intent.

Users who interacted with extsy-token.live should take immediate action to secure their assets and accounts. For cryptocurrency-related scams, revoke any token approvals granted to the domain and transfer funds to a new wallet. If login credentials were entered, change passwords immediately and enable two-factor authentication on all related accounts. Monitor accounts for unauthorized transactions and report the incident to the impersonated brand, OKX, as well as to relevant authorities or platforms like Google Safe Browsing, PhishTank, or local cybercrime units.