cyboshoke[.]com

PhishDestroy identifies cyboshoke.com as an active domain engaged in brand impersonation targeting OKX, a major cryptocurrency exchange. This threat is classified as elevated due to the domain’s deceptive similarity to legitimate brand assets and the potential for financial fraud. The site currently resolves to a Google Trust Services SSL-validated IP address (188.114.97.3), suggesting an attempt to appear legitimate at first glance. Users accessing this domain risk exposure to credential theft, fraudulent transactions, or malware delivery through spoofed login portals or counterfeit OKX interfaces.

This domain was flagged by 3 of 95 VirusTotal security vendors, indicating early but measurable suspicion among threat intelligence platforms. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on February 23, 2025, and despite its recent creation, its association with known impersonation tactics and low trust scores across multiple services warrants immediate caution. The presence of a Google Trust Services SSL certificate does not validate the site’s legitimacy—it merely confirms the encryption layer, not the authenticity of the entity behind the domain.

PhishDestroy assesses cyboshoke.com as an elevated-risk threat due to its clear intent to deceive users into believing it is an official OKX platform. Given its recent registration and partial detection rate, the domain remains active and accessible. All users are advised to avoid interacting with cyboshoke.com or any linked platforms. Cryptocurrency traders should verify URLs through official OKX channels and use browser protections or security extensions to block known malicious domains. Organizations are urged to update threat intelligence feeds with this domain’s indicators (IP 188.114.97.3, registration date, and registrar) to prevent accidental exposure. Immediate reporting to cybersecurity teams and domain registrars is recommended to support takedown efforts.