rrchtoken[.]lat

The domain rrchtoken.lat is a confirmed phishing site engaged in brand impersonation targeting OKX, a cryptocurrency exchange. It poses a specific threat by attempting to deceive users into believing they are interacting with the legitimate OKX platform, potentially leading to unauthorized access to accounts or financial loss. As of the latest verification, rrchtoken.lat has been taken offline, though it previously operated as a cryptocurrency scam without an associated drainer kit.

Technical indicators for rrchtoken.lat show 0 of 95 VirusTotal vendors flagged the domain as malicious, and it was not listed by Google Safe Browsing. However, it appeared on 3 security blocklists, including PhishDestroy, MetaMask, and SEAL. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on February 22, 2026, and resolved to the IP address 172.67.136.133, hosted by Cloudflare, Inc. in the US. The SSL certificate was issued by Let's Encrypt (E7), and the observed page title was 'Un instant…'. Nameservers associated with the domain were audrey.ns.cloudflare.com and rohin.ns.cloudflare.com.

Users who may have interacted with rrchtoken.lat should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new wallet to prevent potential unauthorized transactions. If credentials were entered on the site, change passwords for the impersonated OKX account and enable two-factor authentication (2FA). Report the phishing domain to OKX support and relevant security platforms such as PhishTank or the Anti-Phishing Working Group to aid in broader mitigation efforts.