Possible typosquatted OKX/Binance crypto-fraud domain observed in TLS SNI

Duo Tech@duotech

•updated Aug 14, 2026•0•0•2

Detects TLS SNI and HTTP Host values matching Jewelbug's typosquatted-domain pattern impersonating the OKX and Binance cryptocurrency exchanges, used to drive traffic to cloaked phishing pages.