webxkonodey[.]com

This domain, webxkonodey.com, is flagged as a brand impersonation threat targeting OKX, a cryptocurrency exchange platform. Analysis indicates the site employs a phishing scheme designed to deceive users into entering credentials or transferring funds under the guise of a referral rewards program, as evidenced by the page title containing the referral code 79368771. No drainer kit signatures were identified in available telemetry, but the presence of a referral code suggests an intent to monetize stolen access or funds directly through affiliate fraud or credential harvesting. Infrastructure analysis reveals the domain was registered on April 7, 2026, through Dynadot Inc, an uncommon future-dated registration that may indicate an attempt to evade immediate detection. It resolves to the IP address 54.215.31.113, hosted on infrastructure associated with short-lived phishing campaigns. The domain holds a Gridinsoft trust score of 0/100 and is detected by 14 out of 95 security vendors on VirusTotal. It appears on one security blocklist and was previously flagged by Google Safe Browsing. The SSL certificate is issued by Let's Encrypt, a common choice for malicious actors due to its free and automated issuance process. As of the latest assessment, webxkonodey.com has been taken offline, likely following detection and reporting. The domain was blocked by PhishDestroy, and no active DNS resolution is observed. Despite its current offline status, residual risk remains due to the potential reuse of the referral code or registration of similar domains under the same infrastructure. Users who interacted with the domain are advised to revoke any active sessions, reset credentials, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include the domain and associated IP to prevent future access attempts.