cybebshoke[.]com

cybebshoke.com is a confirmed brand impersonation phishing site targeting OKX, a major cryptocurrency exchange. The domain was designed to deceive users into believing they were on an official OKX platform, likely to harvest login credentials, private keys, or seed phrases. No specific drainer kit was identified in the available intelligence, but the site's structure and behavior strongly suggest intent to steal digital assets.

The technical indicators paint a clear picture of a malicious operation. VirusTotal reports that 7 out of 95 security vendors flagged this domain as malicious, indicating broad detection across the industry. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for low scrutiny, and resolves to IP address 188.114.96.3. Creating the domain on March 27, 2026, less than a month before analysis, is a classic sign of a short-lived phishing campaign. It appears on 1 security blocklist and was found in 1 AlienVault OTX threat intelligence pulse, confirming it was actively monitored by security researchers. The SSL certificate was issued by Google Trust Services / WE1, which is legitimate but frequently abused by phishing sites to appear trustworthy.

As of the latest assessment, cybebshoke.com has been taken offline, effectively neutralizing the immediate threat. However, users who may have visited the site before takedown should take immediate action: change passwords on OKX and any other accounts using the same credentials, enable two-factor authentication, and monitor for unauthorized transactions. The risk of follow-on attacks, such as credential stuffing on other platforms, remains moderate. PhishDestroy strongly advises avoiding any unsolicited links claiming to be from OKX and always verifying URLs directly through official channels.