cybeushoke[.]com

This domain, cybeushoke.com, is identified as part of a phishing campaign targeting users of the cryptocurrency exchange OKX through brand impersonation. The site likely mimics the legitimate OKX platform to deceive visitors into disclosing sensitive credentials, such as login details or private keys, or into executing transactions that result in unauthorized fund transfers. The infrastructure is designed to exploit trust in the OKX brand, potentially leading to financial loss or account compromise for unsuspecting users. Analysis indicates that cybeushoke.com was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. The domain resolves to the IP address 172.67.158.122, hosted by Cloudflare, Inc., a common obfuscation tactic to conceal the true origin of the phishing infrastructure. As of the latest assessment, the domain is flagged by 15 out of 95 security vendors on VirusTotal, and it appears on at least one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), further suggests an attempt to appear legitimate, though it does not mitigate the underlying threat. Users who visited cybeushoke.com are advised to take immediate action to mitigate potential risks. Any credentials or sensitive information entered on the site should be considered compromised and must be changed without delay on the legitimate OKX platform. Affected individuals should also monitor their accounts for unauthorized transactions and enable additional security measures, such as multi-factor authentication. If financial loss is suspected, reporting the incident to relevant authorities and the targeted brand’s security team is recommended to aid in further investigation and mitigation efforts.