VirusTotal
1 / 94
Interpretation & limits
Engine detections from this stored analysis. Vendors and collection times may differ from other sources.
“Redirecting...”
Assessment based on the stored source evidence below. Review sources →
okex.capital — 未验证. 品牌冒充:OKX; 诈骗类型:Brand Impersonation. 证据摘要: VirusTotal 1/94 (SOCRadar); URLQuery 1 alert; PhishDestroy score 56/100. 注册商: NiceNIC.
为保留原始取证记录,下方的 PhishDestroy AI 详细分析仍使用英文。
These are dated observations, not a live safety check. No flag, a stored capture, or a completed analysis does not establish that a site is safe.
1 / 94
Engine detections from this stored analysis. Vendors and collection times may differ from other sources.
1 threat-system alert
报告Alerts refer to the preserved scan. They do not describe the current state of the site.
checked — no match recorded
A result applies to the recorded source and observation time. Absence of a flag is not proof of safety.
10 community references
报告Community publication references, not a vendor verdict or evidence of a common operator.
provider verdict: clean
A result applies to the recorded source and observation time. Absence of a flag is not proof of safety.
存储的报告
A preserved page image documents what the collector received; a capture is not a safety verdict.
分析完成
报告This is the recorded automated analysis. Completion alone is not a safety verdict.
12 已检查 — 未发现拦截
A result applies to the recorded source and observation time. Absence of a flag is not proof of safety.
Checked; no threat flag recorded
报告A result applies to the recorded source and observation time. Absence of a flag is not proof of safety.
| Detection System | Indicator | Verdict | Alert |
|---|---|---|---|
| Private YARA rules | www.okx.com/cdn/assets/okfe/util/ont/5.8.45/ont.js |
audit | Hunting_JS_WebAssembly |
Stored narrative · generated . Provider checks below retain their own observation dates.
okex.capital is a recently activated domain posing as OKX, the global cryptocurrency exchange. Our telemetry reveals it functions as a cryptocurrency drainer, surreptitiously siphoning deposited assets to attacker-controlled wallets under the guise of a legitimate login or deposit portal. Victims who enter their credentials or send funds to the addresses embedded on the fraudulent pages suffer irreversible losses, as blockchain transactions cannot be reversed. The site’s deceptive resemblance to the official okx.com platform is designed to exploit user trust and harvest sensitive wallet information or direct crypto transfers. Early analysis suggests these attacks are manual rather than automated, increasing the chance that the actors behind okex.capital are still iterating on their phishing kit to evade detection. This domain was flagged by PhishDestroy using seed 91a878. Technical indicators include registration through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 12, 2026, and resolution to IP 104.21.29.180. The site leverages a Let’s Encrypt SSL certificate for a veneer of legitimacy despite hosting overtly malicious content. VirusTotal currently shows zero detection out of 95 scanners, indicating the campaign has yet to be widely blocked by antivirus engines. Domain age and registrar choice are consistent with a short-lived campaign aimed at capitalizing on new or inattentive users who do not cross-verify URLs against known official domains. If you visited okex.capital or entered any information, immediately revoke wallet access for any connected applications, transfer remaining assets to a fresh wallet with a new seed phrase, and report the incident to OKX’s fraud team and your local cybercrime unit. Use a hardware wallet for future transactions and avoid clicking links in unsolicited messages. Check domain age with a tool like crt.sh or whois to spot recently registered impostors. Finally, bookmark the authentic OKX URL and use it exclusively for all transactions to prevent future exposure.
Full extracted values, their blockchain and collection source. An address found in page content does not establish who controls it.
https://t.me/OKXOfficial_EnglishStored page referencehttps://t.me/OKXVenturesStored page referenceIoC extraction recorded 2026-08-01 04:16:18 UTC
针对该主机的爬虫与浏览器观察记录,以及针对“Keitaro”式流量分配系统的实时指纹检测。
扫描说明: unavailable: raw=connection_error; http=0; via=http_proxy; error=SOCKSHTTPConnectionPool(host='okex.capital', port=80): Max retries exceeded with url: / (Caused by NewConnectionError("S
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Edge-IP 声誉不属于此域。
alec.ns.cloudflare.comLocation describes the IP network.
d5e772297a87457148848be5414e524929db29c868942f1ab12dc992e250921cSaved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Google PageSpeed Insights — mobile performance audit of okex.capital · checked Apr 15, 2026
10 recorded events. These records describe collected evidence, outgoing notifications and publication; they do not confirm a complete investigation or a takedown.
We scan suspicious URLs, inspect public results and send evidence through the appropriate abuse-reporting channels. The dated events above show what is recorded for this domain. The directory below explains the wider workflow.
Capture the rendered page, requests and visible infrastructure.
Compare the available engine results and retain the analysis timestamp.
Check whether Google currently lists the URL as unsafe.
Inspect a public scan and its recorded network and classification data.
Look for indicator references and related community intelligence.
Compare archived captures and preserve historical context.
Look for matching indicators and associated threat records.
Inspect certificate records and related hostnames.
Compare security resolver responses and record observed blocking.
Inspect the public DNS, TLS, HTTP and technology surface.
Security services used for scanning, reputation checks and reporting are listed below. A service being listed is not evidence that it received, accepted or acted on this particular domain. Recorded submissions appear in the notification history above.
已存储 89 个仿冒域名
由 1 名社区成员报告;首次发现于 2026年4月14日
如果您输入了帐户凭据、个人或付款信息,或者从此域下载了文件,请立即采取措施。以下资源可帮助您报告事件并保护自己。
选择您所在的国家/地区以获取 官方网络犯罪联系人 或 创建投诉草稿 →。
Template-based draft · optional AI wording assistance requires separate consent