cybersbhoke[.]com

This domain, cybersbhoke.com, operates as a brand impersonation platform designed to deceive users of the cryptocurrency exchange OKX. Analysis of the page title, "Инновационная платформа, созданная для настоящих энтузиастов интерактивных соревновательных дисциплин!", suggests an attempt to lure victims under the guise of a competitive or interactive service, likely exploiting trust in the OKX brand to harvest credentials or distribute malicious payloads. The Russian-language content further indicates a targeted approach toward specific user demographics, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with fraudulent domains. It resolves to the IP address 104.21.94.46 and is flagged by 5 out of 95 security vendors on VirusTotal, including detections for phishing and brand impersonation. Additionally, the domain appears on one security blocklist and is referenced in a threat intelligence pulse on AlienVault OTX, reinforcing its classification as an elevated-risk threat. The Gridinsoft trust score of 0/100 further corroborates its malicious nature. Users who visited cybersbhoke.com should immediately revoke any active sessions on the legitimate OKX platform and reset their account credentials using multi-factor authentication. All connected devices should be scanned for malware, particularly browser-based threats or credential stealers. If financial transactions were initiated, affected users should contact their exchange or financial institution to report potential fraud and monitor accounts for unauthorized activity. Given the domain's current offline status, users should remain vigilant for similar impersonation attempts, as threat actors often re-deploy infrastructure under new domains.