cybernhoke[.]com

This domain, cybernhoke.com, is flagged as a brand impersonation phishing site targeting OKX, a major cryptocurrency exchange. Analysis indicates the domain was designed to mimic legitimate OKX login and wallet interfaces, likely to harvest user credentials and facilitate unauthorized transactions. No specific drainer kit has been attributed to this domain at this time, but the infrastructure aligns with common cryptocurrency phishing campaigns observed in 2024 and 2025. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, an unusually future-dated creation that may indicate registry manipulation or data entry error. It resolves to the IP address 104.21.22.142, a Cloudflare-associated endpoint often exploited for anonymity in phishing operations. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and was identified in a single AlienVault OTX threat intelligence pulse, suggesting limited but confirmed malicious activity. As of the latest assessment, cybernhoke.com has been taken offline, likely following detection and remediation efforts by security providers. The domain is currently blocked by at least one known phishing mitigation system. Despite its offline status, residual risk remains due to potential DNS cache persistence or re-registration under altered infrastructure. Organizations and users are advised to maintain blocklist updates, monitor for related domains using the same registrar or IP range, and verify all cryptocurrency transaction URLs against official sources to prevent credential compromise or asset loss.