lybg168[.]com

This domain, lybg168.com, poses a specific threat of brand impersonation, targeting the cryptocurrency exchange platform OKX. The domain mimics the official OKX website by using a similar page title and referral code, potentially misleading users into believing they are interacting with a legitimate service. This deceptive tactic can lead to the compromise of user credentials, financial information, and other sensitive data.

Analysis indicates that 15 out of 95 security vendors on VirusTotal flag this domain as malicious, suggesting a significant level of suspicion and potential risk. The domain was registered through Dynadot Inc on April 20, 2026, and appears on one security blocklist. Infrastructure analysis reveals that the domain resolves to the IP address 54.215.31.113 and uses technologies such as Nginx, React, OpenResty, ThreatMetrix, OneTrust, Naver Analytics, HSTS, and Google Tag Manager. The SSL certificate is issued by Let's Encrypt, which is a common choice for phishing sites to gain user trust.

If users have visited lybg168.com, they should immediately check their OKX accounts for any unauthorized activity. It is recommended to change passwords and enable two-factor authentication (2FA) if not already in place. Users should also monitor their financial transactions and report any suspicious activity to OKX support. Additionally, users should be cautious of any referral links or promotional offers from unfamiliar sources and verify the legitimacy of the website by checking the URL and SSL certificate.