roketbet402[.]com

PhishDestroy has identified roketbet402.com as an elevated-risk brand impersonation threat specifically targeting OKX, a well-known cryptocurrency exchange. This domain was designed to deceive users into believing they are interacting with an official OKX platform, potentially leading to credential theft or financial loss. The site has since been taken offline, but the underlying infrastructure may still pose a risk.

Technical analysis reveals several concerning indicators. VirusTotal data shows that 2 out of 95 security vendors flagged this domain as malicious, indicating a moderate level of detection across the security community. The domain was registered through NiceNIC International Group Co., Limited on February 23, 2026, and resolves to IP address 185.162.229.2. It appears on one security blocklist, and its SSL certificate was issued by Google Trust Services / WE1. Despite the SSL certificate, the site's sole purpose was to impersonate OKX, as evidenced by its page title "roketbet402.com/" lacking any legitimate OKX branding.

Users who may have encountered this domain before it was taken offline should take immediate action. For brand impersonation threats, it is critical to verify the legitimacy of any site by checking the URL carefully, especially when dealing with financial platforms like OKX. If any credentials were entered on roketbet402.com, they should be changed immediately on the official OKX website, and two-factor authentication should be enabled. Additionally, users should monitor their accounts for unauthorized activity and report any suspicious transactions to OKX support. PhishDestroy recommends using a reputable password manager to avoid reusing passwords and to always access cryptocurrency platforms through official apps or bookmarked URLs.