# PhishDestroy domain threat record: cc-okx.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/cc-okx.com/
Machine-readable companion: https://phishdestroy.io/domain/cc-okx.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 11:56:13 UTC
- Last availability or vendor check: 2026-10-28 00:09:04 UTC
- Stored record updated: 2026-10-28 00:09:04 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: OKX

## Stored infrastructure

- Observed IP address: 82.41.66.136
- Registrar in stored WHOIS data: Guizhou Zhongyu Zhike Network Technology Co., Ltd.
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a17810-3e02-7645-823d-03f73826920a/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/cc-okx.com
- Certificate Transparency search: https://crt.sh/?q=%25.cc-okx.com
- Web Archive lookup: https://web.archive.org/web/*/https://cc-okx.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
As observed on 2026-10-26, the captured screenshot shows a plain Chinese placeholder page reading congratulations, site created successfully, stating that the default index page was generated automatically by a system. No login form, buttons or offer appeared at capture time. PhishDestroy listed cc-okx.com as an impersonation phishing page, first seen 2026-10-26 after an admin report when the domain was one day old.

How the scam works
Domains in this category are registered young and left on a placeholder before being swapped for a fake login page that impersonates a trusted brand and harvests account credentials. Visitors arriving from messages may trust the address because it resembles an established service, then hand over passwords or account details to whoever controls the page. The placeholder is a staging artifact rather than a working lure, so later content can change while the address stays the same.

Evidence
The screenshot shows only a default placeholder with no form fields or buttons, while a plain HTTP request to the address was redirected to HTTPS with a 307 status as observed on 2026-10-26. urlscan's machine-learning engine scored the capture malicious at 93 on 2026-10-26, Spamhaus listed the domain in its phishing category, the MetaMask and SEAL blocklists plus PhishDestroy's internal list flagged it, and OTX recorded 4 pulses, all checked 2026-10-26. Google Safe Browsing did not flag it and VirusTotal did not flag the domain as malicious, negatives that do not establish safety.

Infrastructure
Notable weaknesses come first: no Content-Security-Policy, no X-Frame-Options, no X-Content-Type-Options, no Referrer-Policy, no Permissions-Policy and no COOP, COEP or CORP headers; HSTS was set to max-age=31536000. TLS 1.3 with AES-256-GCM, forward secrecy and ALPN h2; email authentication absent with no SPF, DKIM or DMARC observed; CAA record present; DNSSEC unsigned. The domain was registered 2026-10-25 through Guizhou Zhongyu Zhike Network Technology Co., Ltd. and captured behind an nginx server with no WAF shown.

What to do
If you entered credentials on cc-okx.com, change your password on the genuine service and enable two-factor authentication, and be wary of follow-up messages targeting that account. Block cc-okx.com at DNS or proxy level and do not open links to it. Defenders can use the recorded registration and certificate dates from 2026-10-25 to hunt related registrations.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17810-3e02-7645-823d-03f73826920a/
Cloudflare Radar report: https://radar.cloudflare.com/scan/0b5582d9-acbd-4700-8c04-c9da8a4899c2
URLQuery report: https://urlquery.net/report/b954096d-eec9-4294-8c7e-45ae1bf1b355
Stored capture screenshot: https://i.ibb.co/3yK4jR7L/b3f83dc99368.png
Cloudflare Radar screenshot (2026-10-26T12:30:06Z): https://screenshots.phishdestroy.io/cf/0b5582d9-acbd-4700-8c04-c9da8a4899c2.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/b954096d-eec9-4294-8c7e-45ae1bf1b355.png
URLScan screenshot (2026-10-26T12:03:12Z): https://screenshots.phishdestroy.io/us/01a17817-9ba6-770f-83f3-e764e3aaff62.png
URLScan capture report: https://urlscan.io/result/01a17817-9ba6-770f-83f3-e764e3aaff62/
VirusTotal report: https://www.virustotal.com/gui/domain/cc-okx.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=cc-okx.com
Archived copy: https://web.archive.org/web/20261026115731/https://cc-okx.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:16:44 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/3yK4jR7L/b3f83dc99368.png
  Captured: 2026-10-26 11:56:13 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a17810-3e02-7645-823d-03f73826920a.png
  Captured: 2026-10-26 11:56:13 UTC
  Source report: https://urlscan.io/result/01a17810-3e02-7645-823d-03f73826920a/
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17817-9ba6-770f-83f3-e764e3aaff62.png
  Captured: 2026-10-26 12:03:12 UTC
  Source report: https://urlscan.io/result/01a17817-9ba6-770f-83f3-e764e3aaff62/
  SHA-256: 90e330af9167fb4be36cd63eef564155927beb5ba1d2d014c430ecde3576e73f
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/0b5582d9-acbd-4700-8c04-c9da8a4899c2.png
  Captured: 2026-10-26 12:30:06 UTC
  Source report: https://radar.cloudflare.com/scan/0b5582d9-acbd-4700-8c04-c9da8a4899c2
  SHA-256: 2ee3f1b606bca8bc09f6a550dc3869389e5e9102187727163aa955bcf6bd718c
- URLQuery: https://screenshots.phishdestroy.io/uq/b954096d-eec9-4294-8c7e-45ae1bf1b355.png
  Source report: https://urlquery.net/report/b954096d-eec9-4294-8c7e-45ae1bf1b355
  SHA-256: 7d914a368337d17f0e16fdb45a531f00c4bcc0b4042a3028048afb26efb4f40c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T11:58:58Z",
        "uuid": "01a17810-3e02-7645-823d-03f73826920a",
        "scanned_at": "2026-10-26T11:54:59Z",
        "final_url": "https://cc-okx.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://cc-okx.com/",
                "from": "http://cc-okx.com/",
                "status": 307
            }
        ],
        "ip": "82.41.66.136",
        "ips": [
            "82.41.66.136"
        ],
        "asns": [
            "153656"
        ],
        "countries": [
            "HK"
        ],
        "doc_hash": "3b319a1e7740a5e3a99f2b9dd8fcf137f0f32773eb44100b012db3196cc6ae5c",
        "tls": {
            "san": [
                "cc-okx.com"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "cc-okx.com",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-23T08:01:34Z",
            "valid_from": "2026-10-25T08:01:35Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 2,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 93,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T12:32:25Z",
        "uuid": "0b5582d9-acbd-4700-8c04-c9da8a4899c2",
        "scanned_at": "2026-10-26T12:30:06Z",
        "final_url": "https://cc-okx.com/",
        "status": 200,
        "history": [
            {
                "url": "https://cc-okx.com/",
                "status": 200
            }
        ],
        "dom_hash": "d809486d968b06e97c301d72fe7b95d51cc524174f479c9c720fa18a8a1ec7a0",
        "doc_hash": "3b319a1e7740a5e3a99f2b9dd8fcf137f0f32773eb44100b012db3196cc6ae5c",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "cc-okx.com",
                "type": "A",
                "value": "82.41.66.136"
            }
        ],
        "dnssec_valid": false,
        "ip": "82.41.66.136",
        "whois": {
            "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.",
            "created": "2026-10-25T08:47:13Z",
            "updated": "2026-10-25T08:50:03Z",
            "expires": "2027-10-25T08:47:13Z",
            "nameservers": [
                "ns1.kenpains.com",
                "ns2.kenpains.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T12:59:37Z",
        "analysis_at": "2026-10-26T12:28:24Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.",
        "created": "2026-10-25T08:47:13Z",
        "expires": "2027-10-25T08:47:13Z",
        "updated": "2026-10-25T08:50:03Z",
        "first_seen": "2026-10-25T09:06:37Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.kenpains.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "82.41.66.136"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.kenpains.com"
            },
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "admin.kenpains.com",
                "value": "ns1.kenpains.com"
            }
        ],
        "dns_at": "2026-10-26T12:33:46Z",
        "jarm": "3fd3fd0003fd3fd21c42d42d000000bdfc58c9a46434368cf60aa440385763",
        "cert": {
            "san": [
                "cc-okx.com"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "5e1082a36a8f07c808bf9471a588aeac3e",
            "sha256": "13e7f837dd0036338ebb2c46700cad635202144dc609c46e60c6512766b4b2e4",
            "subject": "cc-okx.com",
            "valid_to": "2027-01-23T08:01:34Z",
            "valid_from": "2026-10-25T08:01:35Z"
        },
        "whois": {
            "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.",
            "registrar_iana_id": "3814",
            "registrar_url": "http://www.zuuq.cn",
            "created": "2026-10-25T08:47:13Z",
            "updated": "2026-10-25T08:50:03Z",
            "expires": "2027-10-25T08:47:13Z",
            "status": [
                "ok"
            ],
            "nameservers": [
                "ns1.kenpains.com",
                "ns2.kenpains.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "server hold"
            ],
            "events": {
                "expiration": "2027-10-25T08:47:13Z",
                "last changed": "2026-10-25T08:48:27Z",
                "registration": "2026-10-25T08:47:13Z",
                "registrar expiration": "2027-10-25T08:47:13Z",
                "last update of RDAP database": "2026-10-25T09:06:27Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T12:21:02Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "cc-okx.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-26T11:57:31Z",
            "first": "2026-10-26T11:57:31Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 1060
        },
        "social_tags": {
            "title": "恭喜，站点创建成功！"
        },
        "trackers": {
            "requests": 1
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 901,
                "tls": 188,
                "wait": 185,
                "connect": 185,
                "download": 0
            },
            "response_ms": 1459
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 917,
            "co2_grams": 0,
            "cleaner_than": 95
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "211.99.99.45",
                    "host": "ns1.kenpains.com"
                },
                {
                    "ip": "61.158.128.8",
                    "host": "ns2.kenpains.com"
                }
            ],
            "zone": "cc-okx.com"
        },
        "location": {
            "ip": "82.41.66.136",
            "asn": "153656",
            "org": "OWGELS INTERNATIONAL CO., LIMITED",
            "city": "Hong Kong",
            "country": "HK"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR1",
            "subject": "cc-okx.com"
        },
        "dns": {
            "A": [
                "82.41.66.136"
            ],
            "NS": [
                "ns1.kenpains.com",
                "ns2.kenpains.com"
            ],
            "SOA": "{\"nsname\": \"ns1.kenpains.com\", \"hostmaster\": \"admin.kenpains.com\", \"serial\": 1793017056, \"refresh\": 3600, \"retry\": 300, \"expire\": 1209600, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "82.41.66.136",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://cc-okx.com"
            ]
        },
        "whois": {
            "registrar": "Guizhou Zhongyu Zhike Network Technology Co., Ltd.",
            "created": "2026-10-25T08:47:13Z",
            "updated": "2026-10-25T08:50:03Z",
            "expires": "2027-10-25T08:47:13Z",
            "status": [
                "ok https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.kenpains.com",
                "ns2.kenpains.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```