revoke-kernelsdao[.]com

PhishDestroy identifies revoke-kernelsdao.com as an active brand impersonation scam masquerading as OKX’s KernelDAO initiative to lure cryptocurrency users. The domain presents a deceptive page titled 'KernelDAO – Earn Rewards on Ethereum, BTC & BNB | Kelp, Gain & Kernel,' falsely promising staking rewards while concealing a crypto drainer payload designed to siphon funds from victim wallets upon wallet connection or transaction approval. The threat actor leverages OKX’s branding to establish credibility, targeting users familiar with OKX’s staking services or KernelDAO partnerships.

Technical indicators confirm the malicious nature of this domain. VirusTotal analysis shows 3 out of 95 security vendors have flagged revoke-kernelsdao.com as malicious. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to IP address 188.114.97.3. Notably, the domain was created on April 20, 2026, a recent registration indicative of opportunistic domain squatting. Google Safe Browsing (GSB) has not yet blacklisted the domain, and public blocklist aggregation reveals limited coverage, increasing the risk of exposure to unsuspecting users.

As of the latest assessment, revoke-kernelsdao.com remains active and accessible, demonstrating persistent operational status. Immediate containment actions include updating DNS blocklists, flagging the domain in corporate security tools, and notifying users via security awareness channels to avoid interaction. Despite these measures, the domain’s recent registration and low initial detection rate pose a residual risk, particularly for users engaging with crypto-related services. Continuous monitoring and proactive threat hunting are essential to mitigate potential fallout from this campaign.