cybedshoke[.]com

This domain, cybedshoke.com, poses a targeted brand impersonation threat against users of the OKX cryptocurrency exchange platform. Analysis indicates the site was designed to mimic legitimate OKX login portals, likely to harvest user credentials, private keys, or other sensitive authentication details. The infrastructure supports a crypto drainer or wallet hijacking scheme, where victims unknowingly authorize malicious transactions after entering their credentials. Given the elevated risk level associated with cryptocurrency theft, this domain represents a serious threat to both individual and institutional digital asset holders. Evidence confirms the malicious nature of cybedshoke.com through multiple technical indicators. The domain was registered on March 27, 2026, via NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. VirusTotal detection data shows 4 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist and has been documented in one AlienVault OTX threat intelligence pulse. The domain resolved to the IP address 104.21.40.66, which has been linked to other phishing infrastructure in recent campaigns. Gridinsoft assigned a trust score of 0 out of 100, further corroborating its fraudulent intent. Users who visited cybedshoke.com or entered credentials on the site should immediately revoke any active sessions, reset passwords, and enable multi-factor authentication on their OKX accounts. All connected wallets should be audited for unauthorized transactions, and any suspicious activity reported to the exchange. Browser data, including cookies and saved passwords, should be cleared to eliminate residual session tokens. Cryptocurrency holders are advised to transfer assets to new wallets if they interacted with the site, as private keys may have been compromised. Monitoring for phishing attempts via email or messaging platforms is recommended, as attackers may attempt follow-up social engineering attacks using harvested contact details.