cyberbhoke[.]com

This domain, cyberbhoke.com, is identified as a credential harvesting platform designed to impersonate the OKX cryptocurrency exchange. Analysis indicates the infrastructure is engineered to deceive users into submitting login credentials, API keys, or other sensitive authentication details under the pretense of legitimate OKX services. The phishing pages hosted on this domain likely mimic the exchange’s interface, including login portals, account verification prompts, or withdrawal confirmation dialogues, to exploit user trust in the brand. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 104.21.10.173 and is currently flagged by 4 out of 95 security vendors on VirusTotal, with detections including phishing and brand impersonation classifications. It appears on one security blocklist and has been documented in a single threat intelligence pulse on AlienVault OTX. The Gridinsoft trust score of 0/100 further corroborates its malicious nature, indicating no legitimate use case. Users who have interacted with cyberbhoke.com should immediately revoke any credentials, API keys, or session tokens entered on the site. Affected accounts should be secured by enabling multi-factor authentication and monitoring for unauthorized transactions or access attempts. System scans using updated security tools are recommended to detect potential malware or backdoors installed during the interaction. Organizations should update internal blocklists to include this domain and its associated IP address to prevent further exposure.