okxweb3extension[.]com

PhishDestroy first observed okxweb3extension.com on Apr 22, 2026. The hostname explicitly references OKX; stored content metadata identifies the same apparent target. The captured page title is “403 Forbidden”. Stored page analysis classifies the content as brand impersonation. Current evidence score: 93/100 (critical).

Positive findings are stored from 2 sources: VirusTotal and URLQuery. VirusTotal recorded 13 detections among 91 engines: alphaMountain.ai, BitDefender, CRDF, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, Sophos, VIPRE, Webroot on Aug 8, 2026 at 02:16 UTC. URLQuery recorded 2 detections; no observation timestamp was retained. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 06:20 UTC. On Apr 22, 2026 at 14:12 UTC, Google Safe Browsing returned no flag; PhishStats returned no feed match. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 02:40 UTC.

HTTP 502 server error was recorded on Aug 7, 2026 at 22:14 UTC. Registration records for the domain list TuringSign Inc. d/b/a Cosmotown as the registrar and Mar 22, 2026 as the creation date. At collection time, the hostname resolved to 198.251.84.236 on AS53667 (FranTech Solutions). The recorded endpoint location is Luxembourg, LU. The stored server header is LiteSpeed. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Jun 21, 2026; checked Jul 9, 2026 at 04:00 UTC.

The content indicators and 2 positive source findings support the current OKX-themed brand impersonation classification.