okxmobile[.]com

The domain okxmobile.com is identified as a brand impersonation threat targeting OKX, a cryptocurrency exchange platform. Analysis indicates the domain was designed to mimic legitimate OKX mobile services, likely to deceive users into disclosing credentials or transferring assets. As of the latest assessment, the domain has been taken offline, though prior activity suggests malicious intent. Infrastructure analysis reveals the domain was registered on March 20, 2026, through Name.com, Inc., a registrar commonly associated with both legitimate and malicious registrations. It resolved to the IP address 91.204.64.19, a host with a history of supporting suspicious domains. Detection metrics show the domain was flagged by 3 of 95 security vendors on VirusTotal, while Gridinsoft assigned a trust score of 0 out of 100. The domain appeared on one security blocklist and utilized a Let's Encrypt SSL certificate, a tactic often employed to lend superficial legitimacy. The page title, 'OKX Mobile,' further reinforces the impersonation theme. The current offline status of okxmobile.com does not eliminate the risk of future reactivation or similar campaigns. Organizations and users are advised to monitor for domains registered through the same registrar or resolving to the identified IP address. Blocking access to 91.204.64.19 at the network level is recommended, along with implementing domain-based filtering for newly registered domains mimicking cryptocurrency brands. End-users should verify the authenticity of any OKX-related communications or websites by cross-referencing official channels and enabling multi-factor authentication for all financial accounts.