x-okx-fwd[.]com

Analysis dated July 19 2026 identifies the domain x-okx-fwd.com as an active high‑risk infrastructure used for OKX brand impersonation. The site returns HTTP 200 and is hosted on IP 52.223.13.41, an AWS Global Accelerator endpoint located in Canada. Registration records show Tucows Domains Inc. as the registrar and the authoritative name servers are ns1.renewyourname.net and ns2.renewyourname.net. The TLS certificate is issued by GoDaddy.com (GoDaddy TLS Intermediate CA DV – R1v1), confirming the use of a legitimate‑looking HTTPS connection. The domain appears on three public blocklists and has been cited in two AlienVault OTX pulses, indicating prior detection by the security community. Five of ninety‑one VirusTotal scanners flagged the domain, and it is currently blocked by PhishDestroy, MetaMask, and SEAL. While the exact landing page content has not been publicly disclosed, the combination of blocklist presence, vendor detections, and the explicit brand impersonation tag suggests a credential‑harvesting campaign targeting OKX users. Defenders should add x-okx-fwd.com to URL filtering rules, monitor DNS queries for the associated IP and name servers, and enforce multi‑factor authentication for any OKX‑related accounts. Ongoing observation is recommended to capture any changes in hosting or payload delivery.