ke-okx[.]com

PhishDestroy identifies ke-okx.com as an active high-risk domain engaged in brand impersonation of OKX, a major cryptocurrency exchange. This domain is currently leveraging a fake drainer kit to deceive visitors into connecting wallets and transferring digital assets. The threat actor has deployed a convincing replica of OKX’s interface, specifically targeting users searching for legitimate exchange services or support channels. Impersonation campaigns of this nature typically result in immediate financial loss upon wallet connection or transaction authorization. This domain was flagged on VirusTotal with a 1/95 detection ratio, indicating limited but critical coverage by security vendors.

This domain exhibits multiple technical indicators that confirm its malicious intent and operational status. According to forensic analysis, ke-okx.com resolves to IP address 172.67.169.62 and is backed by an SSL certificate issued by Google Trust Services, which may contribute to a false sense of legitimacy. The domain was registered through Metaregistrar BV on November 12, 2025, indicating a recent and likely opportunistic campaign. With only 1 out of 95 security vendors flagging this domain on VirusTotal, its stealthiness is notable, though its low detection rate also reflects the evolving nature of such threats. The domain remains unlisted on major blocklists at this time, increasing exposure risk to unsuspecting users.

As of the most recent assessment, ke-okx.com remains active and poses a high risk to cryptocurrency users seeking OKX services. PhishDestroy recommends immediate blocking of this domain and IP at the network and DNS levels. Users should verify all exchange-related URLs against official sources and avoid interacting with unsolicited links or pop-ups. The persistence of this threat underscores the need for heightened vigilance in the cryptocurrency ecosystem. While initial detection remains low, proactive threat intelligence and user education are critical to mitigating the spread of similar impersonation campaigns. Remain cautious—this domain is a confirmed active threat and should be treated with the highest level of caution.