okxapp[.]click

This domain is flagged as an elevated-risk brand impersonation threat targeting OKX, a cryptocurrency exchange platform. Analysis indicates the site mimics official OKX app download pages, likely to harvest credentials or distribute malicious software under the guise of legitimate crypto services. Infrastructure analysis reveals the domain was registered on April 21, 2026, through NameSilo, LLC, and currently resolves to IP address 172.67.158.10. Security vendors on VirusTotal flagged the domain with 3/95 detections, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Technologies detected include HSTS, Cloudflare, and HTTP/3, which may be leveraged to obfuscate malicious activity or enhance perceived legitimacy. The page title, "歐易App下載 - OKX官方App註冊 | 比特幣App哪個好？首選歐易," explicitly references OKX and targets Chinese-speaking users, suggesting a focused phishing campaign. Mitigation steps for this threat type include blocking the domain and associated IP (172.67.158.10) at the network perimeter. Organizations should update endpoint protection rules to flag or quarantine any downloads originating from this domain. Users who may have interacted with the site should immediately reset credentials for OKX and any other accounts where the same password was reused. Crypto exchanges and financial platforms should monitor for unusual login attempts or transaction requests linked to this domain. Security teams are advised to review logs for connections to 172.67.158.10 and correlate with any suspicious user activity, particularly in regions where Chinese is the primary language.