cyhershoke[.]com

This domain, cyhershoke.com, represents an elevated-risk brand impersonation campaign targeting users of the OKX cryptocurrency exchange platform. Analysis indicates the infrastructure was specifically designed to mimic legitimate OKX authentication portals, likely to harvest user credentials, private keys, or two-factor authentication codes through deceptive login interfaces. The domain employs social engineering tactics common in cryptocurrency phishing, where victims are tricked into entering sensitive account information under the false pretense of security verification, account upgrades, or reward distributions. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3, hosted by CloudFlare in Canada, a common obfuscation tactic to mask backend infrastructure. Detection metrics show 14 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist, specifically PhishDestroy. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of legitimacy to unsuspecting users. Users who may have interacted with cyhershoke.com should take immediate remedial actions to mitigate potential compromise. First, revoke any active sessions on the legitimate OKX platform and reset account credentials using a secure, non-compromised device. Enable multi-factor authentication if not already active, and monitor account activity for unauthorized transactions or configuration changes. If cryptocurrency wallets or private keys were entered, transfer assets to a new wallet immediately, as credentials may have been exfiltrated. Report the incident to the legitimate platform’s security team and consider filing a report with relevant cybersecurity authorities to aid in tracking the campaign.