# PhishDestroy threat dossier — okex.capital ================================================================ Fetched: 2026-04-21 21:26:05 UTC Canonical: https://phishdestroy.io/domain/okex.capital/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 96/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: OKX ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/94 security vendors flagged this domain Flagging vendors: SOCRadar ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 104.21.29.180 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: Cloudflare, Inc. Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED !!! REGISTRAR INTEGRITY ALERT — NiceNIC !!! NiceNIC International: over 90% of its registered domains are associated with illegal content; documented systematic abuse-report non-response. Primary sources: https://phishdestroy.io/nicenic-real https://phishdestroy.io/nicenic-verdict Nameservers: ["melinda.ns.cloudflare.com", "alec.ns.cloudflare.com"] Registered: 2026-04-14 Expires: 2027-04-12 Page title: Redirecting... HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / E8 Expires: 2026-07-11 Status: INVALID chain Fingerprint: d5e772297a87457148848be5414e524929db29c868942f1ab12dc992e250921c ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-14 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-14 19:33:07 UTC (by PhishDestroy tracker) Last verified: 2026-04-21 23:03:07 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019d8cd3-1e84-7522-afca-4f7f88d4fd8b/ Wayback Machine: https://web.archive.org/web/*/okex.capital crt.sh CT logs: https://crt.sh/?q=%25.okex.capital Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=okex.capital AlienVault OTX: https://otx.alienvault.com/indicator/domain/okex.capital URLhaus: https://urlhaus.abuse.ch/host/okex.capital/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-14 19:34:18 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] okex.capital is a recently activated domain posing as OKX, the global cryptocurrency exchange. Our telemetry reveals it functions as a cryptocurrency drainer, surreptitiously siphoning deposited assets to attacker-controlled wallets under the guise of a legitimate login or deposit portal. Victims who enter their credentials or send funds to the addresses embedded on the fraudulent pages suffer irreversible losses, as blockchain transactions cannot be reversed. The site’s deceptive resemblance to the official okx.com platform is designed to exploit user trust and harvest sensitive wallet information or direct crypto transfers. Early analysis suggests these attacks are manual rather than automated, increasing the chance that the actors behind okex.capital are still iterating on their phishing kit to evade detection. This domain was flagged by PhishDestroy using seed 91a878. Technical indicators include registration through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 12, 2026, and resolution to IP 104.21.29.180. The site leverages a Let’s Encrypt SSL certificate for a veneer of legitimacy despite hosting overtly malicious content. VirusTotal currently shows zero detection out of 95 scanners, indicating the campaign has yet to be widely blocked by antivirus engines. Domain age and registrar choice are consistent with a short-lived campaign aimed at capitalizing on new or inattentive users who do not cross-verify URLs against known official domains. If you visited okex.capital or entered any information, immediately revoke wallet access for any connected applications, transfer remaining assets to a fresh wallet with a new seed phrase, and report the incident to OKX’s fraud team and your local cybercrime unit. Use a hardware wallet for future transactions and avoid clicking links in unsolicited messages. Check domain age with a tool like crt.sh or whois to spot recently registered impostors. Finally, bookmark the authentic OKX URL and use it exclusively for all transactions to prevent future exposure. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 0d103038f292a76aa3a177eabccf8274 TLS cert SHA-256: d5e772297a87457148848be5414e524929db29c868942f1ab12dc992e250921c ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/okex.capital/ JSON API: https://api.destroy.tools/v1/check?domain=okex.capital Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io