jokerwor[.]github[.]io

jokerwor.github.io is an active phishing domain that impersonates the OKX cryptocurrency platform. This site is currently live and poses a high risk to users who may mistake it for a legitimate OKX login or wallet interface. The page title displayed is 'Site not found · GitHub Pages', which is a default GitHub Pages message, suggesting the site may be under construction or deliberately hiding its true content from casual inspection. The domain was created on April 14, 2026, and resolves to IP 185.199.108.153, which is associated with GitHub Pages hosting. It is registered through GitHub, Inc. and uses a Let's Encrypt SSL certificate (R12), which is common among legitimate sites as well, making it harder for users to distinguish based on SSL alone.

Technical indicators show this domain has been flagged by 16 out of 95 security vendors on VirusTotal, indicating broad consensus on its malicious nature. Additionally, Google Safe Browsing flags it as phishing, and it appears on 2 security blocklists. The domain is specifically designed to phish OKX users, potentially via a fake login page or a crypto drainer that steals wallet credentials or funds. The high risk level is warranted given the active status and the targeted nature of the attack against a well-known brand in the cryptocurrency space.

PhishDestroy strongly recommends that users avoid interacting with jokerwor.github.io under any circumstances. If you have already visited this site, do not enter any personal information, passwords, or cryptocurrency wallet details. Immediately change passwords for any accounts that may have been exposed and enable two-factor authentication. Report the domain to security teams and consider running a security scan on your device. Always verify the authenticity of OKX-related sites by using the official URL or bookmarked links, and never trust unsolicited links or emails prompting you to log in.