subershoke[.]com

This domain is flagged for elevated-risk brand impersonation targeting OKX, a cryptocurrency exchange platform. The threat involves deceptive credential harvesting, where attackers mimic legitimate login portals to steal user account access and sensitive financial data. Analysis indicates the domain was designed to exploit trust in the OKX brand, potentially distributing malware or redirecting victims to fraudulent transaction pages under the guise of account verification or promotional offers. Infrastructure analysis reveals the domain subershoke.com was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 172.67.218.219 and is currently offline. The page title, "CYBERSHOKE – CS2 Servers (CSGO)", suggests an attempt to disguise the malicious intent by masquerading as a gaming-related service. VirusTotal reports 3 out of 95 security vendors flagged the domain as malicious, and it appears on one security blocklist. The domain was previously blocked by PhishDestroy, indicating prior detection of phishing activity. Mitigation requires immediate action from security teams and end-users. Network-level protections should block the domain and its associated IP address (172.67.218.219) across all perimeter defenses. Organizations should update endpoint detection rules to flag any attempts to access subershoke.com or related infrastructure. Users who may have interacted with the domain should reset credentials for OKX and any other accounts where passwords were reused. Security teams are advised to monitor for anomalous login attempts or transactions linked to this campaign. Given the domain's offline status, continuous monitoring for re-emergence or related domains registered through the same registrar is recommended.