okjsvip[.]com

This domain is flagged for elevated-risk brand impersonation targeting Across, a decentralized bridging protocol. Analysis indicates the infrastructure was designed to mimic legitimate Across services, likely to deceive users into disclosing sensitive information or interacting with malicious smart contracts. The threat type aligns with known patterns of crypto-related fraud, though no direct evidence of a crypto drainer or fake login portal was confirmed during active monitoring periods. Infrastructure analysis reveals the domain okjsvip.com was registered on March 24, 2025, through InterNetX GmbH and resolved to IP address 104.21.91.187. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and was blocked by PhishDestroy. Detected technologies include WordPress, MySQL, PHP, Yoast SEO Premium, Yoast SEO, LivePerson, jQuery Migrate, and jQuery, suggesting a fully functional but fraudulent web presence. The page title "OKJ" does not correspond to known Across branding, further indicating deceptive intent. Mitigation steps for this threat type include blocking the domain and associated IP at the network perimeter, particularly for organizations handling crypto-related transactions. End users should verify domain authenticity by cross-referencing official Across communication channels before interacting with any bridging services. Security teams are advised to monitor for similar domains registered through InterNetX GmbH or resolving to the same IP range, as these may indicate additional impersonation attempts. Given the domain's current offline status, historical logs should be reviewed for prior interactions, and affected users should be alerted to potential credential exposure or unauthorized transaction attempts.