okxvoting[.]fun

The domain okxvoting.fun is a confirmed phishing site engaged in brand impersonation targeting OKX, a cryptocurrency exchange. It presents itself as a legitimate OKX community voting page but is designed to deceive users into disclosing sensitive information or transferring cryptocurrency under false pretenses. No drainer kit was identified, but the site poses an elevated risk due to its fraudulent representation of the OKX brand. As of the latest verification, okxvoting.fun has been taken offline.

Technical indicators confirm the malicious nature of okxvoting.fun. The domain was flagged by 2 of 95 security vendors on VirusTotal, including Gridinsoft and SOCRadar, with a Gridinsoft trust score of 0/100. It appears on 3 security blocklists: PhishDestroy, MetaMask, and SEAL. Registered through NameSilo, LLC, the domain was created on 2026-02-21 and resolves to the IP address 104.21.39.91, hosted on Cloudflare's network (AS13335) in the US. No SSL certificate was observed, and the page title displayed 'Community Vote | OKX'. Nameservers are khalid.ns.cloudflare.com and nora.ns.cloudflare.com.

Users who interacted with okxvoting.fun should immediately change any passwords or credentials entered on the site and enable two-factor authentication (2FA) on their OKX and related accounts. Monitor accounts for unauthorized transactions and report any suspicious activity to OKX support. To report the phishing domain, submit it to Google Safe Browsing, PhishTank, or the impersonated brand’s abuse team. If cryptocurrency was transferred, contact the relevant exchange or wallet provider to attempt recovery and revoke any active token approvals.