gs-token[.]app

The domain gs-token.app is a sophisticated phishing site designed to impersonate the popular cryptocurrency exchange OKX. Visitors who land on this page may be tricked into entering their login credentials or private keys, believing they are on an official OKX platform. This type of brand impersonation is a common tactic used by crypto drainers to steal funds and sensitive account information. The site poses a significant risk to anyone who may have encountered it, as it could lead to unauthorized access to cryptocurrency wallets and exchanges.

PhishDestroy identified this threat through multiple technical indicators. The domain was registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with malicious domains. It resolves to IP address 172.67.132.189 and uses an SSL certificate issued by Google Trust Services, which can make the fake site appear legitimate to unsuspecting users. Security analysis reveals that 1 out of 95 security vendors on VirusTotal flag this domain as malicious, and it appears on one security blocklist. Additionally, AlienVault OTX has recorded it in one threat intelligence pulse, confirming its association with phishing campaigns.

If you have visited gs-token.app, take immediate action to protect your accounts. Do not enter any personal information, and if you did, change your OKX password and enable two-factor authentication. Monitor your accounts for suspicious activity and consider contacting OKX support. PhishDestroy recommends always verifying URLs by typing the official domain directly into your browser and using bookmark links instead of clicking on unsolicited links. Stay vigilant against crypto phishing attempts to safeguard your digital assets.