bybitprokx[.]com

The domain bybitprokx.com impersonates the cryptocurrency exchange OKX, aiming to deceive users into entering sensitive information. Despite being offline now, the domain was flagged by 5 out of 94 vendors on VirusTotal, indicating its malicious intent. PhishDestroy's blocklist also includes this domain, underscoring its threat level.

Registered through TuringSign Inc. d/b/a Cosmotown and hosted on an IP managed by Cloudflare, Inc., the domain was set up to mimic a legitimate exchange. The SSL certificate issued by Google Trust Services suggests an attempt to appear credible. However, the page title "Just a moment..." often signals a deceptive site designed to stall users while malicious scripts execute.

The domain's creation date in 2026 is likely a typographical error or manipulation, as it conflicts with current detection data. This anomaly could be part of the scam strategy to evade detection. Although the site is currently offline, the presence on PhishDestroy's blocklist and VirusTotal detections highlight the potential risk it posed to users seeking to engage with OKX. The swift takedown reflects effective monitoring and response efforts to protect users from phishing threats.