playjoker[.]cfd

The domain playjoker.cfd is associated with a phishing scam impersonating OKX. It was detected by PhishDestroy on the same day it was created, June 12, 2026. Despite the domain being taken down, it had already been flagged as malicious by 4 out of 91 VirusTotal vendors, indicating its potential threat level. The site was hosted on IP 188.114.96.3 and registered with NameCheap, Inc., using an SSL certificate issued by Google Trust Services.

This domain was designed to deceive users by mimicking the OKX brand, a common tactic in phishing schemes. The rapid detection by PhishDestroy highlights the effectiveness of their pipeline in identifying threats before they propagate through antivirus databases. This is crucial as phishing domains often exploit the 24-72 hour window between registration and detection by most AV vendors.

The platform risk score for playjoker.cfd was notably high at 86/100, underscoring the potential danger it posed to unsuspecting users. Although the site is now offline, its brief period of activity could have been enough to compromise sensitive user information. The domain's status as unreachable with a 523 error further confirms its current inactivity, but the initial detection and risk assessment remain valuable for ongoing threat analysis and prevention strategies.