# smokedworld.biz — SUSPICIOUS

> smokedworld.biz is an active OKX brand impersonation phishing site with 0/95 VirusTotal detections. Check the full report.

## Summary
PhishDestroy identifies smokedworld.biz as an active phishing domain impersonating the OKX cryptocurrency exchange to deceive users into surrendering credentials or financial data. This domain leverages visual replication of OKX branding to establish false legitimacy, creating a convincing replica of the legitimate okx.com interface. The threat actor behind this campaign registered the domain through NICENIC INTERNATIONAL GROUP CO., LIMITED on January 06, 2023, and has deployed it via IP address 172.67.190.99. The infrastructure currently shows no detections on VirusTotal (0/95 engines), indicating low immediate detection but high exploitation potential.  

This domain was flagged under brand impersonation with confirmed alignment to PhishDestroy seed identifier 8a2556. Technical indicators include resolution to Cloudflare IP 172.67.190.99 and use of a Google Trust Services SSL certificate, which may mislead users into assuming authenticity. The domain’s registration predates most recent brand monitoring windows, enabling prolonged exposure. Despite zero antivirus detection at time of analysis, the combination of recent creation (Jan 2023), active hosting, and targeted impersonation elevates the risk to “under investigation” due to potential for rapid escalation.  

Users who visited smokedworld.biz should immediately cease interaction with the site and check their OKX accounts for unauthorized access. Enable two-factor authentication (2FA) if not already active, and review transaction history for suspicious activity. Do not enter credentials or financial information into any page linked from smokedworld.biz. Report the domain to OKX support and local cybercrime units. Organizations should consider blocking the domain and IP 172.67.190.99 at the network perimeter. Always verify URLs via official OKX channels before engaging with login or financial prompts.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: OKX

## Domain Intelligence
- Registered: 2023-01-06 15:13:45
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 172.67.190.99

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/06229a9a-35cf-4515-9086-fb790a2b0555
- PhishDestroy: https://phishdestroy.io/domain/smokedworld.biz/
- LLM endpoint: https://phishdestroy.io/domain/smokedworld.biz/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/smokedworld.biz/
Last updated: 2026-03-26