web3okx[.]life

Analysis as of July 24, 2026 indicates that the domain web3okx.life was registered on February 21, 2026 and is presently taken offline. The site presented a page titled “RCADE airdrop checker | OKX”, which aligns with a known airdrop‑scam phishing kit. The domain resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. SSL inspection shows a certificate labeled WE1, providing no additional trust signals.

The domain has been flagged by seven of ninety‑three VirusTotal scanners, and it appears on two independent security blocklists, specifically PhishDestroy and ScamSniffer. These blocklists have already listed the domain as malicious, and the same classification appears in other threat‑intelligence feeds. The page title explicitly references OKX, confirming that the campaign attempts to impersonate the OKX brand. No further content analysis is available beyond the title, so the exact page structure, credential‑capture mechanisms, or malicious payloads remain unknown.

Defenders should immediately add web3okx.life to DNS and URL filtering policies, enforce blocklisting of the associated IP 188.114.97.3, and monitor Cloudflare‑originated traffic for re‑registration attempts. Continuous re‑scanning with sandbox and endpoint detection tools is advised in case the site reappears under a new host or certificate. Organizations using OKX services should alert users to disregard unsolicited airdrop checks that reference OKX, and SOC teams should correlate any login or wallet activity with this indicator of compromise. The combination of brand impersonation, a known airdrop kit, and multiple vendor detections warrants an elevated risk rating and proactive defensive measures.