eexkomn[.]com

This domain, eexkomn.com, is actively impersonating the cryptocurrency exchange OKX as part of a high-risk phishing campaign. Registered on November 28, 2025, through Dynadot Inc., the domain resolves to IP address 170.33.96.18, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The page title, 'Obtenez des récompenses lorsque vous commencez sur OKX | Mon code de parrainage : 32128560 | OKX,' explicitly references OKX and includes a referral code, a common tactic to lure victims into fraudulent reward schemes. Infrastructure analysis reveals the use of Nginx and OpenResty as web servers, alongside React for frontend development. Additional technologies detected include ThreatMetrix, OneTrust, Naver Analytics, HSTS, and Google Tag Manager, suggesting an attempt to mimic legitimate security and analytics practices. The domain employs nameservers ns1.dyna-ns.net and ns2.dyna-ns.net and presents a 302 HTTP redirect, a technique often used to obscure malicious destinations. The SSL certificate is issued by Let's Encrypt, a common but not inherently suspicious provider. Security vendors have flagged the domain, with three out of 91 engines on VirusTotal identifying it as malicious. Gridinsoft assigns a trust score of 0/100, and the domain appears on at least one security blocklist. The scam type is classified as brand impersonation, specifically an airdrop scam, targeting users with false reward offers. While the exact content of the site remains unanalyzed, the combination of infrastructure, registration details, and detected technologies strongly indicates malicious intent. Defenders should treat this domain as an active threat, prioritizing blocking at the DNS and network levels. Monitoring for related domains registered through the same registrar or hosted on the same IP range may help identify additional components of this campaign.