okxwallet[.]world

Analysis of the domain okxwallet.world indicates active brand impersonation targeting OKX, a cryptocurrency exchange and wallet provider. The domain was registered on December 26, 2025, through Name.com, Inc., and currently resolves to the IP address 185.158.133.1, hosted on Cloudflare’s network (AS13335) in Poland. No SSL certificate is present, and the HTTP status code returned is 409, which may suggest misconfiguration or intentional blocking by the hosting provider. The domain appears on four security blocklists, and Gridinsoft assigns it a trust score of 0 out of 100.

Twelve out of 93 security vendors on VirusTotal flag the domain as malicious, reinforcing its classification as a crypto scam. Detection engines from PhishDestroy, Polkadot, Enkrypt, and Codeesura have explicitly blocked access to this domain, further corroborating its fraudulent nature. The page title, 'OKX Wallet: Eine Krypto-Wallet für Web3, DeFi & Multi-Chains,' directly impersonates OKX’s branding, targeting German-speaking users. Infrastructure analysis reveals the use of four nameservers under Name.com (ns1glr.name.com, ns2cqs.name.com, ns3ghw.name.com, ns4lrt.name.com), a pattern consistent with domains registered through the same registrar for malicious campaigns.

While the exact content of the site remains unanalyzed, the combination of brand impersonation, low trust scores, and multiple vendor detections confirms high-risk activity. Defenders should treat this domain as an active threat, block resolution at the DNS level, and monitor for related domains registered through the same infrastructure. No legitimate association with OKX is known or implied by the available evidence.