cybermhoke[.]com

PhishDestroy has identified cybermhoke.com as a domain engaged in brand impersonation targeting OKX, a prominent cryptocurrency exchange platform. The domain was created on March 27, 2026, and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with malicious registrations. The threat type is brand impersonation, where the domain attempts to mimic OKX to deceive users into divulging sensitive information or credentials. No specific drainer kit was identified in the available intelligence, but the domain's configuration and purpose strongly suggest a phishing campaign.

Technical indicators reveal that cybermhoke.com resolves to IP address 188.114.96.3, which is associated with Cloudflare. VirusTotal flagged the domain with a score of 3 out of 95 security vendors, indicating relatively low but notable detection. The domain appears in 1 security blocklist and was found in 1 threat intelligence pulse on AlienVault OTX. The SSL certificate is issued by Google Trust Services, specifically WE1, which is legitimate but can be abused by malicious actors. Notably, the domain is not present on Google Safe Browsing (GSB) lists as of the time of analysis. The domain's age is very recent, which is a common characteristic of phishing domains that are deployed quickly and taken down before widespread detection.

As of the latest analysis, cybermhoke.com has been taken offline, indicating that response actions have been effective in mitigating the immediate threat. However, residual risk remains because the domain could be reactivated or the same threat actor could register similar domains. PhishDestroy recommends that organizations and individuals remain vigilant against unsolicited communications purporting to be from OKX. Users should verify the authenticity of any OKX-related emails or websites by checking official channels and using multi-factor authentication. Security teams should monitor for any new domains mimicking OKX and ensure that blocklists are updated to include this domain. Additionally, it is advisable to review any accounts that may have been exposed to this domain and to enable security alerts for any unusual activity.