cybeshroke[.]com

PhishDestroy identifies cybeshroke.com as an active brand impersonation phishing domain targeting OKX users. This domain employs deceptive tactics to mimic the legitimate OKX platform, likely aiming to harvest credentials or facilitate cryptocurrency theft. No drainer kit artifacts have been confirmed at this stage, but the domain’s configuration aligns with typical phishing infrastructure designed for fraudulent transactions or data exfiltration.

This domain resolves to IP 172.67.210.196 and utilizes a Google Trust Services SSL certificate, suggesting an attempt to appear legitimate. cybeshroke.com was registered on April 18, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently exhibits a VirusTotal detection rate of 2/95. It has been flagged by one security blocklist and remains unflagged by Google Safe Browsing (GSB) at this time. The combination of a recently registered domain, lack of detections, and impersonation of a major cryptocurrency exchange raises significant concerns about its malicious intent.

As of this report, the domain is classified as under investigation with an active status, blocked by PhishDestroy. Immediate mitigation includes domain blocking and user awareness campaigns to prevent access. However, the absence of broader security detections and the domain’s recent creation introduce a latent risk, particularly for users accustomed to OKX communications. Organizations and individuals are advised to avoid interacting with cybeshroke.com and report any observed activity to relevant security teams.