cybersiooke[.]com

PhishDestroy has identified cybersiooke.com as a brand impersonation threat targeting the cryptocurrency exchange OKX. This domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and is designed to deceive users into believing they are on a legitimate OKX platform, likely to harvest login credentials or seed phrases. The domain's threat type is brand impersonation, and while no specific drainer kit has been identified, the risk of credential theft is elevated.

Technical indicators reveal that cybersiooke.com resolves to IP address 188.114.97.3 and holds an SSL certificate issued by Google Trust Services for WE1. VirusTotal analysis shows 3 out of 95 security vendors flagging this domain as malicious, and it appears on one security blocklist. AlienVault OTX has recorded the domain in one threat intelligence pulse, indicating community awareness. The domain was created just recently, suggesting a short-lived campaign aimed at exploiting trust in the OKX brand.

Currently, cybersiooke.com is offline, which may indicate that the hosting provider or registrar has taken action in response to reports. However, the domain could be reactivated or redirected, so users should remain vigilant. PhishDestroy recommends that all OKX users verify URLs by visiting the official OKX website directly, avoiding clicking on links from unsolicited messages. If you have already interacted with this domain, change your OKX password immediately and enable two-factor authentication. Monitor your accounts for unauthorized activity and report any suspicious transactions to OKX support.