listingsokx[.]info

This domain, listingsokx.info, poses a brand impersonation threat targeting users of the OKX cryptocurrency exchange platform. The site is designed to mimic legitimate OKX properties, likely to deceive visitors into disclosing sensitive credentials, authorizing fraudulent transactions, or interacting with malicious smart contracts. Given the elevated risk level and historical use of similar domains, this infrastructure may have been part of a broader campaign to facilitate cryptocurrency theft or unauthorized access to user accounts. Analysis indicates the domain was flagged by 9 out of 95 security vendors on VirusTotal, reflecting broad consensus on its malicious nature. The domain was registered on February 21, 2026, through an unnamed registrar, and appears on at least one security blocklist. Infrastructure analysis reveals it resolved to the IP address 188.114.96.3, utilized Cloudflare services, and employed HTTP/3 for communication. The page title 'Just a moment...' suggests the use of anti-bot or cloaking mechanisms to evade detection or analysis. Users who visited listingsokx.info should immediately revoke any active sessions or authorizations granted to unknown applications, particularly those related to cryptocurrency wallets or exchange accounts. Monitor financial and account activity for unauthorized transactions. If credentials were entered, reset passwords and enable multi-factor authentication on all associated accounts. Consider scanning the device used to access the domain for malware or unauthorized modifications, as brand impersonation sites often distribute additional payloads.