foloke[.]top

PhishDestroy has flagged foloke.top (registered February 15, 2026) as an active crypto drainer domain impersonating OKX. This domain leverages brand impersonation to trick users into connecting malicious wallets or entering credentials, enabling unauthorized crypto transfers. Currently, it remains undetected on VirusTotal with 0/95 engines flagging it, highlighting the importance of proactive threat hunting. The domain resolves to IP 188.114.97.3 and is registered through PDR Ltd. d/b/a PublicDomainRegistry.com, with an SSL certificate issued by Google Trust Services, adding a veneer of legitimacy. The technical indicators for this threat include a newly minted domain (February 15, 2026), a low VirusTotal detection ratio (0/95), and a hosting IP (188.114.97.3) linked to suspicious activity. Notably, the domain’s SSL certificate is issued by Google Trust Services, which may lull users into a false sense of security. While the domain itself is not yet blocklisted, its rapid registration and alignment with known impersonation tactics warrant immediate attention. The absence of detections on VirusTotal suggests this campaign is either freshly launched or employs evasion techniques to bypass initial scans. To mitigate the risk posed by foloke.top, users must avoid interacting with the domain entirely. For OKX users, always navigate directly to the official website (okx.com) via verified bookmarks or search engine results. Enable wallet connection confirmations and review all transaction details before approval. Report suspicious domains to PhishDestroy for analysis and potential blocking. Organizations should monitor network traffic for connections to IP 188.114.97.3 and update blocklists accordingly. Proactive user education on recognizing impersonation tactics remains critical to preventing unauthorized access and fund loss.