okxfinance[.]top

This domain, okxfinance.top, operates as a high-risk brand impersonation phishing site specifically targeting users of the OKX cryptocurrency exchange platform. Analysis of the page content reveals a fraudulent Chinese-language download portal titled 'OKX下载 - 数字货币交易所APP | 加密货币交易平台APP,' which mimics the legitimate OKX mobile application distribution page. The site is designed to deceive users into downloading malicious software or entering sensitive credentials, likely facilitating unauthorized access to cryptocurrency wallets or the deployment of crypto-draining malware. The use of localized language and official branding elements increases the likelihood of successful social engineering attacks against Chinese-speaking users. Infrastructure analysis provides multiple indicators of malicious intent. The domain was registered on May 15, 2024, through Namecheap Inc., a registrar frequently abused for phishing operations. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain resolves to IP address 188.114.97.3 and is blocked by MetaMask, PhishDestroy, and SEAL security systems. It appears on three independent security blocklists, and Scamadviser rates it with a low trust score of 31/100. Detected technologies include Cloudflare and HTTP/3, which are commonly used to obfuscate malicious infrastructure and evade detection. Users who visited okxfinance.top should immediately revoke any permissions granted to applications downloaded from the site and disconnect connected wallet services. Cryptocurrency wallet addresses used on the platform should be considered compromised, and all associated funds should be transferred to new, secure wallets. Affected users should scan their devices with updated security software to detect potential malware infections. Browser extensions or mobile applications installed after visiting the site should be removed, and all account credentials for cryptocurrency exchanges should be changed from a secure device. Monitoring for unauthorized transactions is recommended for at least 30 days following exposure.