zunepok-ex[.]win

This domain, zunepok-ex.win, poses a significant threat as a brand impersonation site designed to deceive users of the OKX cryptocurrency exchange. The site mimics legitimate OKX login pages or promotional offers, potentially tricking visitors into entering sensitive credentials, private keys, or wallet recovery phrases. Such attacks often lead to unauthorized access to crypto wallets, resulting in fund theft or account takeovers. The page title 'ZunePok' suggests an attempt to create a false association with OKX, further increasing the risk of user deception. Analysis indicates this domain is part of a coordinated phishing campaign. It was registered on December 19, 2025, through Gname.com Pte. Ltd., a registrar frequently observed in fraudulent domain registrations. The domain is flagged by 18 out of 95 security vendors on VirusTotal, with detections from multiple threat intelligence platforms, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. Additional technical indicators include resolution to the IP address 104.21.50.97, hosted behind Cloudflare (AS13335), and an SSL certificate issued by Google Trust Services (WE1). Google Safe Browsing also classifies this domain as phishing, reinforcing its malicious nature. If you visited zunepok-ex.win, immediate action is required to mitigate potential damage. Disconnect any active sessions and avoid entering further credentials. If you provided login details, change your OKX password and enable multi-factor authentication (MFA) on all linked accounts. For crypto wallet exposure, transfer funds to a new wallet and revoke any connected dApp permissions. Monitor financial accounts for unauthorized transactions and consider reporting the incident to relevant cybersecurity authorities or the impersonated brand’s fraud team. Users should also scan their devices for malware, as phishing sites may distribute additional payloads.