# PhishDestroy domain threat record: cyou-okx.com.cn

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/cyou-okx.com.cn/
Machine-readable companion: https://phishdestroy.io/domain/cyou-okx.com.cn/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 13:40:30 UTC
- Last availability or vendor check: 2026-10-23 13:40:30 UTC
- Stored record updated: 2026-10-23 18:21:07 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: OKX

## Stored infrastructure

- Observed IP address: 82.41.66.136
- Registrar in stored WHOIS data: 万商云集（成都）科技股份有限公司
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a168fc-0649-736f-89d4-ba85fd3ea6b8/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/cyou-okx.com.cn
- Certificate Transparency search: https://crt.sh/?q=%25.cyou-okx.com.cn
- Web Archive lookup: https://web.archive.org/web/*/https://cyou-okx.com.cn/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy classified the domain as suspicious based on a Google Safe Browsing social‑engineering flag. The recorded page title is “欧易官网 - okx官网 - 欧易交易所”, which references the OKX exchange. The domain was first observed by PhishDestroy on 2026-10-23.

How the scam works
The listing reflects a common impersonation tactic where attackers host pages that appear to belong to a legitimate cryptocurrency exchange in order to trick users into entering login credentials or downloading counterfeit applications. No specific malicious actions such as credential capture or wallet interaction were observed on the captured page. The risk therefore lies in potential credential harvesting or social‑engineering deception.

Evidence
Google Safe Browsing marked the site as SOCIAL_ENGINEERING on 2026-10-23. Spamhaus DBL listed the domain as phishing on the same date. External blocklists MetaMask and SEAL flagged the domain on 2026-10-23. URLScan’s automated analysis on 2026-10-23 returned a malicious phishing verdict with a score of 100 and identified the OKX brand. VirusTotal scanned the domain on 2026-10-23 and reported 0 detections out of 92 engines. OTX recorded four pulses mentioning the domain as of 2026-10-23. PhishDestroy’s internal blocklist includes the domain as of 2026-10-23.

Infrastructure
The recorded IP address is 82.41.66.136, belonging to OWGELS INTERNATIONAL CO., LIMITED in Hong Kong. The TLS certificate issued by Let’s Encrypt was observed on 2026-10-22 and is valid until 2027-01-20. Domain and apex ages were reported as 0 days at the time of capture. Nameservers are ns1.kenpains.com and ns2.kenpains.com, and the IP is announced by ASN 153656.

What to do
Visitors should avoid entering any OKX credentials or downloading software from this site; if credentials were entered, change the passwords on the real OKX account and enable two‑factor authentication. Security teams should block traffic to cyou-okx.com.cn, monitor access logs for connections to this exact address, and consider reporting the domain to Google Safe Browsing and the registrar. Merely visiting the site does not prove compromise, but precautionary measures are recommended.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a168fc-0649-736f-89d4-ba85fd3ea6b8/
Cloudflare Radar report: https://radar.cloudflare.com/scan/7a3f3a34-f652-45a9-8043-3c5934749c0b
URLQuery report: https://urlquery.net/report/c6a934a9-e203-4bae-95c6-d3b3474e7ecd
Stored capture screenshot: https://urlscan.io/screenshots/01a168fc-0649-736f-89d4-ba85fd3ea6b8.png
Cloudflare Radar screenshot (2026-10-23T13:41:04Z): https://screenshots.phishdestroy.io/cf/7a3f3a34-f652-45a9-8043-3c5934749c0b.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/c6a934a9-e203-4bae-95c6-d3b3474e7ecd.png
URLScan screenshot (2026-10-23T12:54:44Z): https://screenshots.phishdestroy.io/us/01a168d3-e0a0-77c6-b8af-543dbfea3f56.png
URLScan capture report: https://urlscan.io/result/01a168d3-e0a0-77c6-b8af-543dbfea3f56/
URLScan screenshot (2026-10-23T13:09:35Z): https://screenshots.phishdestroy.io/us/01a168e1-72f9-7703-a307-7d1f4bd0e040.png
URLScan capture report: https://urlscan.io/result/01a168e1-72f9-7703-a307-7d1f4bd0e040/
URLScan screenshot (2026-10-23T13:21:42Z): https://screenshots.phishdestroy.io/us/01a168eb-480f-70ee-bb96-5e7fbd867a9c.png
URLScan capture report: https://urlscan.io/result/01a168eb-480f-70ee-bb96-5e7fbd867a9c/
VirusTotal report: https://www.virustotal.com/gui/domain/cyou-okx.com.cn
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=cyou-okx.com.cn
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 14:48:42 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a168fc-0649-736f-89d4-ba85fd3ea6b8.png
  Captured: 2026-10-23 13:40:30 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a168fc-0649-736f-89d4-ba85fd3ea6b8.png
  Captured: 2026-10-23 13:40:30 UTC
  Source report: https://urlscan.io/result/01a168fc-0649-736f-89d4-ba85fd3ea6b8/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/7a3f3a34-f652-45a9-8043-3c5934749c0b.png
  Captured: 2026-10-23 13:41:04 UTC
  Source report: https://radar.cloudflare.com/scan/7a3f3a34-f652-45a9-8043-3c5934749c0b
  SHA-256: 22199e8cc145948f1b208c769a8a0be38b6c7138e955d9764ed32ead8d4ef460
- URLQuery: https://screenshots.phishdestroy.io/uq/c6a934a9-e203-4bae-95c6-d3b3474e7ecd.png
  Source report: https://urlquery.net/report/c6a934a9-e203-4bae-95c6-d3b3474e7ecd
  SHA-256: 4d834ab5b77b25abb7aa8ad7a94f79bf1dac2f92b0790884ca71e0fddf5a4c53
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a168d3-e0a0-77c6-b8af-543dbfea3f56.png
  Captured: 2026-10-23 12:54:44 UTC
  Source report: https://urlscan.io/result/01a168d3-e0a0-77c6-b8af-543dbfea3f56/
  SHA-256: 3f24801964131f724710a8aebe868ea087a35ba4ec45cf219cdf1f32f9c26607
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a168e1-72f9-7703-a307-7d1f4bd0e040.png
  Captured: 2026-10-23 13:09:35 UTC
  Source report: https://urlscan.io/result/01a168e1-72f9-7703-a307-7d1f4bd0e040/
  SHA-256: e6e0ec18074d1bf696a576f59ddd33f3fccfa74bee714b879764c695de89cb41
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a168eb-480f-70ee-bb96-5e7fbd867a9c.png
  Captured: 2026-10-23 13:21:42 UTC
  Source report: https://urlscan.io/result/01a168eb-480f-70ee-bb96-5e7fbd867a9c/
  SHA-256: e48a2e957d3b8eb7cf653247910ea6247cea9dd9f1c72fa53fe44fb21ad5d870

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T13:41:20Z",
        "uuid": "01a168fc-0649-736f-89d4-ba85fd3ea6b8",
        "scanned_at": "2026-10-23T13:38:37Z",
        "final_url": "https://cyou-okx.com.cn/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://cyou-okx.com.cn/",
                "from": "http://cyou-okx.com.cn/",
                "status": 307
            }
        ],
        "ip": "82.41.66.136",
        "domains": [
            "www.okx.com"
        ],
        "ips": [
            "2a06:98c1:3103::ac40:9052",
            "82.41.66.136"
        ],
        "asns": [
            "13335",
            "153656"
        ],
        "countries": [
            "HK"
        ],
        "link_domains": [
            "www.okx.com"
        ],
        "doc_hash": "71970c5550d4a2cf5dc1453ebae4f2d08c989b453f404ee76ad0b2153276805f",
        "cookies": [
            "__cf_bm"
        ],
        "tls": {
            "san": [
                "cyou-okx.com.cn"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR2",
            "subject": "cyou-okx.com.cn",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-20T02:37:11Z",
            "valid_from": "2026-10-22T02:37:12Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 3,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "okx"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "OKX"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T13:41:25Z",
        "uuid": "7a3f3a34-f652-45a9-8043-3c5934749c0b",
        "scanned_at": "2026-10-23T13:41:04Z",
        "final_url": "https://cyou-okx.com.cn/",
        "status": 200,
        "history": [
            {
                "url": "https://cyou-okx.com.cn/",
                "status": 200
            }
        ],
        "dom_hash": "f59a916a59ec043f0a6049d173ab54ce5549c4060862deff6b6556931af72045",
        "doc_hash": "71970c5550d4a2cf5dc1453ebae4f2d08c989b453f404ee76ad0b2153276805f",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "cyou-okx.com.cn",
                "type": "A",
                "value": "82.41.66.136"
            }
        ],
        "dnssec_valid": false,
        "ip": "82.41.66.136",
        "whois": {
            "registrar": "万商云集（成都）科技股份有限公司",
            "created": "2026-10-22T11:19:57Z",
            "expires": "2027-10-22T11:19:57Z",
            "nameservers": [
                "ns1.kenpains.com",
                "ns2.kenpains.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T14:46:06Z",
        "analysis_at": "2026-10-23T14:18:45Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "first_seen": "2026-10-22T03:40:34Z",
        "dns": [
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "admin.kenpains.com",
                "value": "ns1.kenpains.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.kenpains.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.kenpains.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "82.41.66.136"
            }
        ],
        "dns_at": "2026-10-23T14:24:14Z",
        "jarm": "3fd3fd0003fd3fd21c42d42d000000bdfc58c9a46434368cf60aa440385763",
        "cert": {
            "san": [
                "cyou-okx.com.cn"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "51993ebc2ec029db133898138636ce67864",
            "sha256": "477c7bfb64f553e4db54c4b34f822453a6e16fa9acd27ebd35cf2ff7ed3e5879",
            "subject": "cyou-okx.com.cn",
            "valid_to": "2027-01-20T02:37:11Z",
            "valid_from": "2026-10-22T02:37:12Z"
        },
        "whois": {
            "status": [
                "ok"
            ],
            "nameservers": [
                "ns1.kenpains.com",
                "ns2.kenpains.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T13:41:48Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "cyou-okx.com.cn"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "social_tags": {
            "title": "欧易官网 - okx官网 - 欧易交易所",
            "author": "OKX 欧易",
            "ogType": "website",
            "robots": "index,follow,max-snippet:-1,max-image-preview:large,max-video-preview:-1",
            "ogImage": "https://www.okx.com/favicon.ico",
            "ogTitle": "OKX欧易官网 | 安卓App下载与注册入口",
            "keywords": "OKX,欧易,OKX官网,OKX安卓下载,欧易App下载,OKX注册,数字资产交易平台,Web3钱包,OKX下载入口",
            "ogSiteName": "OKX 欧易",
            "themeColor": "#04100D",
            "description": "OKX欧易是领先的数字资产交易平台，提供现货、合约、Web3钱包、赚币理财等一站式服务。本页提供OKX安卓App下载指引与官方注册入口，毫秒级撮合引擎、深度流动性、储备金实时可查。",
            "twitterCard": "summary_large_image",
            "ogDescription": "毫秒级撮合引擎、深度流动性、储备金实时可查。立即下载 OKX 安卓 App 或完成注册，开启数字资产之旅。"
        },
        "trackers": {
            "requests": 1
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 235,
                "tls": 187,
                "wait": 366,
                "connect": 183,
                "download": 1
            },
            "response_ms": 972
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "carbon": {
            "bytes": 33945,
            "co2_grams": 0.0012,
            "cleaner_than": 45
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "1.193.216.197",
                    "host": "ns2.kenpains.com"
                },
                {
                    "ip": "218.98.111.227",
                    "host": "ns1.kenpains.com"
                }
            ],
            "zone": "cyou-okx.com.cn"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "__cf_bm",
                    "secure": true,
                    "http_only": true,
                    "same_site": "None"
                }
            ]
        },
        "location": {
            "ip": "82.41.66.136",
            "asn": "153656",
            "org": "OWGELS INTERNATIONAL CO., LIMITED",
            "city": "Hong Kong",
            "country": "HK"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR2",
            "subject": "cyou-okx.com.cn"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "82.41.66.136",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://cyou-okx.com.cn"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Nginx",
                "HSTS",
                "Open Graph"
            ]
        },
        "social_presence": {
            "profiles": [
                "https://x.com/okx"
            ]
        },
        "linked_pages": {
            "external": [
                "https://www.okx.com/zh-hans/register"
            ],
            "external_count": 1,
            "internal_count": 7
        },
        "whois": {
            "registrar": "万商云集（成都）科技股份有限公司",
            "created": "2026-10-22T09:19:57Z",
            "expires": "2027-10-22T09:19:57Z",
            "status": [
                "ok"
            ],
            "nameservers": [
                "ns1.kenpains.com",
                "ns2.kenpains.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```