cyberghoke[.]com

This domain, cyberghoke.com, is identified as a brand impersonation threat specifically targeting OKX, a cryptocurrency exchange platform. Analysis confirms the domain was designed to deceive users by mimicking legitimate OKX services, likely for credential harvesting or fraudulent transactions. As of the latest assessment, the domain has been taken offline, though prior activity remains a concern for historical exposure. Infrastructure analysis reveals cyberghoke.com was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, an unusually future-dated registration that may indicate suspicious intent. The domain resolved to IP address 172.67.174.152 and was flagged by 5 of 95 security vendors on VirusTotal, indicating moderate detection. It appeared on 1 security blocklist and was included in 1 AlienVault OTX threat intelligence pulse. The Gridinsoft trust score for this domain is 0/100, reflecting zero confidence in its legitimacy. Additionally, the domain was blocked by PhishDestroy, further corroborating its malicious classification. Current status confirms cyberghoke.com is offline, reducing immediate risk of active exploitation. However, organizations and users should treat any prior interaction with this domain as compromised. Recommended actions include: (1) blocking the domain and associated IP (172.67.174.152) at network perimeter devices, (2) reviewing logs for connections to cyberghoke.com or its IP, (3) resetting credentials for any accounts accessed during the domain's active period, particularly OKX-related accounts, (4) monitoring for secondary phishing attempts using similar domain names or impersonation tactics, and (5) reporting the domain to relevant threat intelligence platforms to support community defense efforts. Future vigilance is advised, as threat actors may re-establish infrastructure under similar naming conventions.