# PhishDestroy domain threat record: ecn-okx.com.cn

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/ecn-okx.com.cn/
Machine-readable companion: https://phishdestroy.io/domain/ecn-okx.com.cn/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-10-16 14:23:40 UTC
- Last availability or vendor check: 2026-10-21 22:32:49 UTC
- Stored record updated: 2026-10-22 14:22:03 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: OKX

## Stored infrastructure

- Observed IP address: 38.76.193.157
- Registrar in stored WHOIS data: 北京新网数码信息技术有限公司

## Evidence links

- URLScan report: https://urlscan.io/result/01a14522-2380-75d9-ad4a-542110df65b1/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/ecn-okx.com.cn
- Certificate Transparency search: https://crt.sh/?q=%25.ecn-okx.com.cn
- Web Archive lookup: https://web.archive.org/web/*/https://ecn-okx.com.cn/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
ecn-okx.com.cn is a phishing page that impersonates OKX, the crypto exchange known in China as 欧易. It is aimed at Chinese-speaking OKX customers. Its page title presents it as an "OKX Data Terminal", a market-data dashboard and digital-asset analysis tool. PhishDestroy first flagged it on 2026-10-16, and the site has been dead and unreachable since 2026-10-19.

How the scam works
The page borrows OKX's Chinese and English names and wraps them in the language of a professional trading terminal. The pitch is an official analytics panel for serious traders. Pages like this usually move the visitor from browsing charts to a step that requires logging in or linking an account. That step hands over OKX credentials, 2FA codes, API keys or wallet secrets, and attackers use them to empty the account. The title advertises a data dashboard rather than a login page, but the domain is classified as OKX impersonation phishing.

Evidence
On 2026-10-16, VirusTotal showed 0 detections out of 92 engines, so antivirus-based filters would not have warned visitors at that point. Other sources did flag it. urlscan.io returned a malicious verdict and matched the page to the OKX brand. The domain is listed by PhishDestroy, MetaMask and SEAL. Spamhaus DBL classifies it as spam, and four AlienVault OTX threat pulses reference it.

Infrastructure
The domain was registered on 2026-10-14, just two days before PhishDestroy caught it, and it went offline on 2026-10-19, after a working life of under a week. It was registered through 北京新网数码信息技术有限公司 (Xinnet) under the .com.cn space. The site was hosted on cognetcloud INC's COGNETCLOUD-2 network, a US-registered network with the address located in Hong Kong. Its TLS certificate came from TrustAsia's LiteSSL CA, so the padlock in the browser said nothing about whether the site was genuine.

What to do
If you entered OKX login details on this site, change your OKX password from the official app right away. Reset 2FA and review active sessions and devices. Delete any API keys you created or pasted, and check your withdrawal address whitelist for entries you did not add. If you typed a seed phrase or private key, treat that wallet as compromised and move the funds to a new one. Defenders should block the domain and watch for lookalike "OKX data terminal" branding on fresh .com.cn registrations, since VirusTotal alone did not catch this one.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a14522-2380-75d9-ad4a-542110df65b1/
VirusTotal report: https://www.virustotal.com/gui/domain/ecn-okx.com.cn
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ecn-okx.com.cn
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:13:18 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/xSdw6fZG/c8b7f9b3e40c.png
  Captured: 2026-10-16 14:34:46 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a14522-2380-75d9-ad4a-542110df65b1.png
  Captured: 2026-10-16 14:34:46 UTC
  Source report: https://urlscan.io/result/01a14522-2380-75d9-ad4a-542110df65b1/
- URLScan capture 2: https://urlscan.io/screenshots/01a144df-6d02-77ca-8158-ae1b2a81c695.png
  Captured: 2026-10-16 14:23:40 UTC
  Source report: https://urlscan.io/result/01a14522-2380-75d9-ad4a-542110df65b1/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/92bf5768-3a86-434e-8f55-e7a95f14855a.png
  Captured: 2026-10-16 14:27:14 UTC
  Source report: https://radar.cloudflare.com/scan/92bf5768-3a86-434e-8f55-e7a95f14855a
  SHA-256: 3e703dc6b2f0832ef57e81e7ac5a58564c7c08ab6393e9afd4a4d6674d06e60a
- URLQuery: https://screenshots.phishdestroy.io/uq/34c0407d-a660-4cdd-b27b-040dd012bf31.png
  Source report: https://urlquery.net/report/34c0407d-a660-4cdd-b27b-040dd012bf31
  SHA-256: 2d11882aa02b92c3d82b5abe6e27eee0dde10ee982bc698e7b35fe7160a9f1a1
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a144df-6d02-77ca-8158-ae1b2a81c695.png
  Captured: 2026-10-16 13:21:07 UTC
  Source report: https://urlscan.io/result/01a144df-6d02-77ca-8158-ae1b2a81c695/
  SHA-256: c7659c8140ff2ba690a2083eb2b73b9a41cecb9f004be999582b48dfdb8d8ce4
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a1451c-a43b-77fc-b989-60c718b4ad67.png
  Captured: 2026-10-16 14:28:00 UTC
  Source report: https://urlscan.io/result/01a1451c-a43b-77fc-b989-60c718b4ad67/
  SHA-256: 5c2814394c2ace989a489ed3eb06ce34382c7d4b40d3767f69e1ef5a9f8fc262
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a1486e-448e-75a4-8a48-8cab1c11e606.png
  Captured: 2026-10-17 05:55:56 UTC
  Source report: https://urlscan.io/result/01a1486e-448e-75a4-8a48-8cab1c11e606/
  SHA-256: 5cff38bd4cc25b6ad1523d1305d22e3bfb576f6c552bbfb9be47321fe632f3dc

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:45:30Z",
        "uuid": "01a14522-2380-75d9-ad4a-542110df65b1",
        "scanned_at": "2026-10-16T14:33:56Z",
        "final_url": "https://ecn-okx.com.cn/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://ecn-okx.com.cn/",
                "from": "http://ecn-okx.com.cn/",
                "status": 307
            }
        ],
        "ip": "38.76.193.157",
        "ips": [
            "38.76.193.157"
        ],
        "asns": [
            "401701"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "www.toprvkxwhpm.com",
            "www.mitnpkwxvfr.net"
        ],
        "doc_hash": "713d571e19ab8a394378c9ce5f7511331957585a1d8e326af3a89eedf43a29e9",
        "script_hashes": [
            "5e593b09082f9373dd5c13c28bf88645d6e0fff6c45978f3a11aca7a0be409a9"
        ],
        "tls": {
            "san": [
                "www.ecn-okx.com.cn",
                "ecn-okx.com.cn"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "LiteSSL RSA CA 2025",
            "subject": "www.ecn-okx.com.cn",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-14T01:59:59Z",
            "valid_from": "2026-10-16T02:00:00Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "okx"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "OKX"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T17:58:48Z",
        "uuid": "92bf5768-3a86-434e-8f55-e7a95f14855a",
        "scanned_at": "2026-10-16T14:27:14Z",
        "final_url": "https://ecn-okx.com.cn/",
        "status": 200,
        "history": [
            {
                "url": "https://ecn-okx.com.cn/",
                "status": 200
            }
        ],
        "dom_hash": "97372123459ba0b4d02840084a6f2b8b4cadea69de6e6d4fbdfe4f95b78a9259",
        "doc_hash": "713d571e19ab8a394378c9ce5f7511331957585a1d8e326af3a89eedf43a29e9",
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "ecn-okx.com.cn",
                "type": "A",
                "value": "38.76.193.157"
            }
        ],
        "dnssec_valid": false,
        "ip": "38.76.193.157",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "北京新网数码信息技术有限公司",
            "created": "2026-10-14T20:13:32Z",
            "expires": "2027-10-14T20:13:32Z",
            "nameservers": [
                "ns11.xincache.com",
                "ns12.xincache.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-20T19:44:46Z",
        "analysis_at": "2026-10-18T16:49:30Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 2,
            "suspicious": 0,
            "undetected": 36
        },
        "detections": {
            "CRDF": "malicious",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "first_seen": "2026-10-16T03:48:25Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns12.xincache.com"
            },
            {
                "ttl": 180,
                "type": "SOA",
                "rname": "ns12.xincache.com",
                "value": "ns11.xincache.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns11.xincache.com"
            }
        ],
        "dns_at": "2026-10-18T16:49:35Z",
        "jarm": "3fd3fd0003fd3fd00042d42d0000002059a3b916699461c5923779b77cf06b",
        "cert": {
            "san": [
                "www.ecn-okx.com.cn",
                "ecn-okx.com.cn"
            ],
            "issuer": "TrustAsia Technologies, Inc. / LiteSSL RSA CA 2025",
            "serial": "61ed77869700e02cd029a9b91f409ceba73c9ffd",
            "sha256": "070da208ce53497afc590d410e1a0f94f3a94f71feb36bc70c0826abba7b6ee2",
            "subject": "www.ecn-okx.com.cn",
            "valid_to": "2027-01-14T01:59:59Z",
            "valid_from": "2026-10-16T02:00:00Z"
        },
        "whois": {
            "status": [
                "ok"
            ],
            "nameservers": [
                "ns11.xincache.com",
                "ns12.xincache.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```