okx-web[.]app

The domain okx-web.app is identified as a high-risk brand impersonation threat specifically targeting OKX, a major cryptocurrency exchange and wallet provider. Analysis confirms this domain is designed to deceive users into believing it is the legitimate OKX Wallet portal, potentially facilitating credential theft or cryptocurrency drainer attacks. As of the latest assessment, the domain has been taken offline, though prior activity remains a significant concern for users who may have interacted with it. Infrastructure analysis reveals multiple concrete indicators of malicious intent. The domain is flagged by 11 of 95 security vendors on VirusTotal, with Google Safe Browsing categorizing it under SOCIAL_ENGINEERING. It appears on two security blocklists and is associated with a Gridinsoft trust score of 0/100. The domain was registered through Sav.com, LLC on May 13, 2026, an anomalous creation date likely intended to evade detection or appear legitimate. It resolves to the IP address 37.49.229.75 and employs technologies such as LiteSpeed and Naver Analytics, which are not typical for the impersonated brand. Additionally, the domain is referenced in one AlienVault OTX threat intelligence pulse, further corroborating its malicious classification. Given the high-risk nature of this domain, users who accessed okx-web.app should assume potential exposure to credential theft or cryptocurrency loss. Immediate actions include revoking any connected wallet permissions, resetting passwords for associated accounts, and monitoring for unauthorized transactions. Organizations and security teams are advised to block the domain and its resolving IP address (37.49.229.75) at the network level to prevent further access. Users should only interact with the official OKX domain (okx.com) and verify SSL certificates to ensure authenticity. Continuous monitoring of threat intelligence feeds for related infrastructure is recommended to mitigate future risks.