cyberlshoke[.]com

cyberlshoke.com has been flagged by PhishDestroy for active brand impersonation targeting OKX, currently under investigation. This domain poses a credible threat due to its clear intent to deceive users by mimicking a well-known cryptocurrency exchange. Security teams are advised to treat this as a high-priority alert and take immediate defensive measures.

PhishDestroy’s initial assessment reveals that cyberlshoke.com was registered on April 13, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP 188.114.97.3. The domain currently carries a Google Trust Services SSL certificate, which may lend it an air of legitimacy to unsuspecting users. Despite its recent creation, this domain has already been flagged by 1 security blocklist and remains undetected by VirusTotal, with 0 detections out of 95 vendors. The absence of detections suggests this domain may be newly deployed or employing evasive tactics to bypass initial scrutiny.

Given the domain’s active status, its impersonation of OKX—a major cryptocurrency platform—poses significant risks of credential theft or crypto drainer activity. While the threat level is currently marked as under investigation, the combination of a recent registration date, low blocklist coverage, and zero VirusTotal detections warrants heightened caution. Organizations and users are strongly advised to block cyberlshoke.com at the network perimeter and DNS level. Additionally, security teams should monitor for any user reports of interaction with this domain or associated IPs, and consider updating threat intelligence feeds to include this indicator. Proactive user awareness training to recognize impersonation attempts is also recommended to mitigate potential exposure.