ok-pay[.]com

On July 27, 2026, the domain ok-pay.com was observed in a phishing investigation. Registration data indicates the domain was created through GoDaddy.com, LLC and remains active. DNS resolution is served by Cloudflare, using the authoritative name servers brenda.ns.cloudflare.com and rick.ns.cloudflare.com. An HTTP request to the root URL returns a 301 redirect, suggesting intentional redirection as part of the malicious flow.

The domain is currently listed on one security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that at least one reputable anti‑phishing consortium has identified it as malicious. VirusTotal reports that the domain has been scanned by 91 independent scanners, and none have raised a detection at the time of analysis; however, the absence of a detection does not constitute a safety guarantee. No additional intelligence such as page title, SSL certificate details, or hosting IP address was provided, leaving the underlying infrastructure and potential target brand unconfirmed. The limited evidence points to a classic credential‑harvesting operation, but the exact phishing lure, associated landing pages, and victim demographic remain unknown.

Defenders should add ok-pay.com to outbound filtering rules, ensure DNS resolvers block the domain, and monitor network traffic for redirects to the 301 target. Organizations employing web‑proxy or secure web gateway solutions should also consider injecting the domain into their URL filtering lists. Periodic WHOIS checks are recommended to detect any change in registrar status or name‑server configuration that could signal a shift in hosting strategy. Continuous re‑evaluation is advised, as future scans may reveal new indicators or vendor detections.