spokx[.]com

This domain, spokx.com, is actively engaged in brand impersonation targeting OKX, a cryptocurrency exchange platform. Analysis indicates the domain is designed to deceive users into believing they are interacting with legitimate OKX services, likely for credential harvesting or fraudulent transactions. No specific drainer kit signatures have been identified, but the domain's infrastructure aligns with known impersonation tactics in the cryptocurrency sector. Infrastructure analysis reveals the domain was registered on December 23, 2013, through Gname.com Pte. Ltd. It resolves to the IP address 43.255.31.40, hosted under AS133199 (SonderCloud Limited) in Hong Kong. VirusTotal reports 13 out of 95 security vendors flagging this domain as malicious. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious domains. No Google Safe Browsing (GSB) hits are currently recorded, but the domain remains under active scrutiny. As of the latest assessment, spokx.com remains active and unresolved. The domain continues to pose a high risk due to its persistent impersonation of OKX and lack of takedown. Organizations are advised to block the domain at the DNS level and monitor for related indicators of compromise, including the associated IP address 43.255.31.40. Users should be educated on verifying domain authenticity before interacting with cryptocurrency platforms, particularly those involving financial transactions or sensitive data.