shnaoke[.]com

shnaoke.com was registered on March 28, 2026 through the registrar Gname 195 Inc. The domain resolves to the IP address 198.252.106.100, which is hosted by Hawk Host Inc in the United States. Authoritative nameservers dm1.longmingdns.com and dm2.longmingdns.com are configured for the zone, and the site presents a valid Let's Encrypt TLS certificate, indicating that HTTPS is deliberately enabled.

Network and hosting analysis shows the server is running Nginx with PHP support and HTTP Strict Transport Security (HSTS) is enforced. The observed stack is typical for commodity web hosting platforms. The domain is listed on three public security blocklists and has been referenced in two AlienVault OTX threat pulses, confirming prior intelligence sharing. Additionally, it is actively blocked by PhishDestroy, MetaMask, and SEAL, suggesting that multiple mitigation providers have identified it as malicious.

The primary malicious behavior attributed to shnaoke.com is brand impersonation of the cryptocurrency exchange OKX. While the exact page content and credential‑harvesting scripts have not been publicly released, the presence on specialized blocklists and the targeting of OKX indicate a high‑confidence phishing campaign. The lack of VirusTotal detections does not imply benignity; the domain may be employing a low‑profile payload or a novel kit that has not yet been scanned.

Defenders should add the domain and its resolving IP to deny‑list rules at perimeter firewalls and DNS resolvers. Continuous monitoring of the nameserver records is advisable, as the operator could pivot to additional IPs or subdomains. Security teams handling OKX‑related incidents should treat any credential submission to shnaoke.com as potentially compromised and advise users to verify URLs before entering authentication details. Threat‑intel feeds should be updated to include the current indicator set to accelerate downstream blocking.