bafkreihpwq3bupowolyw7e3sdwo2gximnjcmwu5namthyiq7vqe24froke[.]ipfs[.]dweb[.]link

The domain bafkreihpwq3bupowolyw7e3sdwo2gximnjcmwu5namthyiq7vqe24froke.ipfs.dweb.link has been identified as an elevated-risk brand impersonation threat targeting OKX. This IPFS-based domain is designed to deceive users into believing they are accessing legitimate OKX services, likely for the purpose of stealing login credentials or deploying crypto drainers. As of the latest analysis, the domain has been taken offline, but its infrastructure remains a concern for users who may have encountered it previously.

Technical indicators reveal that this domain resolves to the IP address 209.94.90.3 and was registered through CSC Corporate Domains, Inc. on June 3, 2026. It appeared on one security blocklist at the time of analysis. VirusTotal flagged this domain with 21 out of 95 security vendors detecting malicious activity, indicating a moderate but notable consensus among security solutions. The domain displayed a "400 Bad Request" page title, which may have been a default error page or a deliberate attempt to appear inactive while still serving malicious content to specific visitors.

The domain is currently offline, which reduces immediate risk, but users should remain vigilant. PhishDestroy strongly recommends that anyone who interacted with this domain review their OKX accounts for unauthorized access and enable two-factor authentication. Avoid clicking on links from unsolicited messages or emails claiming to be from OKX, and always verify the official domain (okx.com) before entering credentials. For further verification, use PhishDestroy's lookup tool to check the safety of any suspicious domain.