votingokx[.]net

PhishDestroy has identified votingokx.net as an active phishing domain specifically targeting users of the cryptocurrency exchange OKX through brand impersonation. The domain is currently offline, but during its operation it posed a significant threat by attempting to harvest credentials or sensitive information from unsuspecting visitors. This type of attack is common in the crypto space, where fake login pages are used to steal account access.

The domain was created on April 29, 2026, and registered through PDR Ltd. d/b/a PublicDomainRegistry.com, with the IP address 188.114.97.3. It was flagged by 2 out of 95 security vendors on VirusTotal and appeared on 3 blocklists. Additionally, AlienVault OTX reported it in one threat intelligence pulse. The SSL certificate was issued by Let's Encrypt (E7), which is typical for many phishing sites. The page title displayed "Just a moment...", a common placeholder used to evade detection.

Although votingokx.net is no longer active, users who may have encountered it should immediately change their OKX passwords and enable two-factor authentication if they suspect any compromise. PhishDestroy recommends always verifying URLs before entering credentials and using trusted bookmark links rather than clicking unsolicited links. Stay vigilant against similar phishing attempts targeting cryptocurrency platforms.