okxweb[.]app

The domain okxweb.app has been identified as a brand impersonation phishing site targeting OKX, a prominent cryptocurrency exchange platform. Analysis indicates the site mimics the official OKX Wallet interface, presenting itself under the page title 'OKX Wallet: One Crypto Wallet To Web3, DeFi & Multi-Chains.' This domain is currently offline, though it remains under active investigation due to its deceptive infrastructure and association with fraudulent activity. Infrastructure analysis reveals the domain was registered through Google LLC and resolves to the IP address 163.61.188.2. Despite its malicious intent, the domain has not been flagged by any of the 95 vendors on VirusTotal, yielding a 0/95 detection score. However, it appears on six security blocklists, including Codeesura, Polkadot, PhishDestroy, PhishingArmy, and Enkrypt. Detected technologies include LiteSpeed, Naver Analytics, and HTTP/3, which may have been leveraged to enhance the site's perceived legitimacy or evade detection mechanisms. The current offline status of okxweb.app does not eliminate the risk posed by its infrastructure, as threat actors may reactivate or repurpose the domain. Organizations and users are advised to block the domain and its associated IP address (163.61.188.2) at the network level. Security teams should monitor for any re-emergence of the domain or similar impersonation attempts targeting OKX or other cryptocurrency platforms. Additionally, users who may have interacted with the site should verify their accounts for unauthorized access and enable multi-factor authentication on all cryptocurrency-related services. Proactive threat intelligence sharing is recommended to mitigate potential downstream risks.