wwwgrowthweb[.]systems

The domain wwwgrowthweb.systems was registered through Dynadot Inc on April 11, 2026 and is served by the authoritative name servers ns1.dyna-ns.net and ns2.dyna-ns.net. DNS resolution points to IP address 54.215.31.113, an AWS EC2 instance located in the US West-1 region. The site presents a TLS certificate issued by Let’s Encrypt (R12) and returns an HTTP 302 status code. The page title reads "Earn rewards when you get started on OKX | My referral code: 84682055 | OKX Europe," indicating a brand impersonation attempt that aligns with a known airdrop phishing kit. VirusTotal analysis shows 2 of 94 security vendors flagging the domain, while Gridinsoft assigns a trust score of 0 out of 100. The domain appears on one security blocklist and has been blocked by PhishDestroy. The risk level is classified as high and the infrastructure remains active. Defenders should block the domain and its associated IP, monitor DNS queries to the Dynadot name servers, and consider preemptive filtering of traffic to any subdomains that may be generated. Continued observation of the redirect target and any payload delivery mechanisms is recommended to fully assess the threat landscape.