token-forte[.]com

PhishDestroy’s automated threat-intelligence pipeline has flagged token-forte.com (seed 301795) as an active OKX brand-impersonation site designed for crypto-drainer operations. The domain mimics OKX’s branding to trick visitors into connecting wallets or entering credentials, enabling direct asset exfiltration. Registrant details show creation on April 03, 2026, a Let’s Encrypt SSL certificate, and hosting at IPv4 188.114.97.3 via NICENIC INTERNATIONAL GROUP CO., LIMITED—indicators consistent with fast-flux criminal infrastructure. Independent validation across VirusTotal shows the domain currently enjoys 4/95 detection coverage despite its recent activation, highlighting the evasion gap between threat-actor speed and vendor coverage. This combination of fresh creation date, low age on blocklists, and zero detections places token-forte.com in the early, high-risk phase where user education and blocking are the most effective mitigations. Continued monitoring may trigger higher-confidence classifications as additional telemetry accumulates. If you have visited token-forte.com or entered any credentials, immediately revoke connected wallet permissions using your wallet’s “Connected Apps” or “Revoked” section. Clear browser cookies and run a reputable malware scanner; consider rotating exposed API keys and passwords from a clean device. Report the domain to your antivirus vendor and to PhishDestroy’s abuse feed (abuse@phishdestroy.com) to accelerate global blocking. Stay vigilant—new domains using this seed are appearing daily and are likely to remain undetected for at least 24–48 hours.