o-okxcn[.]com

PhishDestroy identifies o-okxcn.com as a live crypto drainer domain that impersonates OKX, the major cryptocurrency exchange. This site is designed to trick users into connecting their wallets or entering login credentials, after which it silently drains tokens. Security researchers note that once a wallet is connected, unauthorized transactions can occur without additional approval, making these pages especially dangerous for users with balances on OKX. This domain was flagged on March 1, 2025, and first appeared in VirusTotal scans on the same day with zero out of ninety-five detection engines flagging it. It resolves to IP address 122.10.46.169 and was registered through Gname.com Pte. Ltd., a registrar known for bulk and privacy-protected registrations commonly exploited in impersonation campaigns. The site uses a Let’s Encrypt SSL certificate, which may give a false sense of legitimacy to visitors who rely on HTTPS indicators. If you visited o-okxcn.com or entered any information, disconnect your wallet immediately and revoke any connected permissions using your wallet’s security settings. Do not approve any unexpected transactions. Report the domain to PhishDestroy for further analysis and update your antivirus definitions. Always verify links by typing the official URL (okx.com) directly into your browser and enable two-factor authentication on all exchange accounts.