access-okx[.]com

This domain, access-okx.com, is flagged as a high-risk brand impersonation threat targeting OKX, a cryptocurrency exchange platform. Analysis indicates the site mimics legitimate OKX authentication pages, as evidenced by the page title 'Securing access,' which aligns with typical user verification workflows. No direct evidence of a crypto drainer kit was observed, but the infrastructure is consistent with credential theft or account takeover attempts designed to compromise user funds or sensitive data.

Infrastructure analysis reveals the domain was registered on May 12, 2026, through CNOBIN INFORMATION TECHNOLOGY LIMITED, a registrar frequently associated with malicious registrations. It resolves to the IP address 193.169.194.67, hosted on AS214576 (Berdiev Ruslan Mukhabatovich) in Germany. The domain is currently detected by 12 out of 95 security vendors on VirusTotal and appears on three independent security blocklists. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites due to its low-cost and automated issuance process. Google Safe Browsing status is not explicitly provided, but the blocklist presence and vendor detections suggest active malicious classification.

As of the latest verification, access-okx.com remains active and unresolved, posing an ongoing risk to users. Response actions by security providers include blocking by PhishDestroy, MetaMask, and SEAL, indicating industry-wide recognition of the threat. Users are advised to avoid interaction with the domain, and organizations should implement network-level blocking for the IP and domain. Given the high-risk classification and active status, continuous monitoring is recommended to track potential shifts in infrastructure or additional malicious payloads.