cobershoke[.]com

This domain, cobershoke.com, is flagged as a brand impersonation phishing site targeting OKX, a cryptocurrency exchange platform. Analysis indicates the infrastructure was designed to deceive users into divulging credentials or transferring assets by mimicking the legitimate OKX interface. No specific drainer kit signatures were identified in available telemetry, though the domain exhibits characteristics consistent with credential harvesting and wallet-draining schemes commonly associated with cryptocurrency phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 172.67.208.147, which is associated with a content delivery network, potentially masking the true origin of the malicious infrastructure. VirusTotal reports 2 out of 95 security vendors flagging the domain as malicious, suggesting limited but confirmed detection. The domain appears on one security blocklist, and no entries were found in Google Safe Browsing at the time of analysis. Current status indicates the domain has been taken offline, likely in response to detection and reporting. While the immediate threat has been mitigated, residual risk remains due to the potential for the operators to re-establish infrastructure under a new domain or IP address. Users who interacted with the domain prior to its takedown should assume credential compromise and take immediate action, including revoking active sessions, rotating passwords, and monitoring for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.