revoke-steakhouse[.]app

PhishDestroy has flagged revoke-steakhouse.app (seed 6bb864) as an active domain engaged in brand impersonation targeting OKX, a major cryptocurrency exchange. This domain mimics OKX’s branding to deceive users into surrendering credentials or installing malware, leveraging urgency (e.g., 'revoke access') common in credential-harvesting campaigns. The threat actor operates a spoofed site designed to exploit user trust in legitimate platforms, a tactic increasingly prevalent in crypto-related phishing. This domain resolves to IP 172.67.150.242 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 30, 2026. Notably, VirusTotal currently reports 2/95 detections, indicating it evades most antivirus engines, while the Let's Encrypt SSL certificate lends it a veneer of legitimacy. Although not yet widely blocklisted, its recent creation and affinity for OKX branding suggest emerging malicious activity. Users who visited revoke-steakhouse.app are advised to immediately disconnect from the internet, revoke any shared credentials via OKX’s official site, and scan devices for malware. Report the domain to OKX’s fraud team and your local cybersecurity authority. Avoid clicking links from unsolicited emails or messages referencing 'revoked' accounts, as these often precede such lures. Proactively monitor financial accounts for irregularities.