# PhishDestroy domain threat record: fire-okx.com.cn

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/fire-okx.com.cn/
Machine-readable companion: https://phishdestroy.io/domain/fire-okx.com.cn/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 13:06:50 UTC
- Last availability or vendor check: 2026-10-23 13:06:50 UTC
- Stored record updated: 2026-10-23 18:21:24 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: OKX

## Stored infrastructure

- Observed IP address: 23.231.153.34
- Registrar in stored WHOIS data: Web Commerce Communications Limited
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-15 12:20:48 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a168de-3084-72f3-b248-df8520549213/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/fire-okx.com.cn
- Certificate Transparency search: https://crt.sh/?q=%25.fire-okx.com.cn
- Web Archive lookup: https://web.archive.org/web/*/https://fire-okx.com.cn/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI classified fire-okx.com.cn as malicious because the page title and content use the OKX brand to present an Android app download and account registration, a pattern associated with credential‑theft or wallet‑drainer schemes. The domain was first observed by PhishDestroy on 2026-10-23 and returned an HTTP 200 response at that time.

How the scam works
Attackers publish a website that mimics a legitimate cryptocurrency exchange’s branding and offer a downloadable client, hoping victims will install malicious software or submit login credentials. Harvested credentials or a compromised app can then be used to access the victim’s real exchange account or to move funds without authorization.

Evidence
VirusTotal scanned the domain on 2026-10-21 with 92 engines and reported zero malicious or suspicious detections. Google Safe Browsing checked the URL on 2026-10-23 and did not flag it. OTX listed four pulses referencing fire-okx.com.cn as of 2026-10-23, and PhishDestroy’s internal blocklist marked the domain as malicious on 2026-10-23. The captured page metadata from 2026-10-23 shows the title “欧易OKX官网 - okx安卓 - 欧易” and a description advertising an OKX Android app version v6.92.0 for download.

Infrastructure
The recorded IP was 23.231.153.34, the recorded network was POWER LINE (HK) CO., LIMITED in Hong Kong, ASN 132839, and the recorded nameservers were ns1.julydns.com and ns2.julydns.com. The TLS certificate observed on 2026-10-21 was issued by TrustAsia Technologies, Inc. / LiteSSL RSA CA 2025 for fire-okx.com.cn and was valid from 2026-10-21 to 2027-01-19.

What to do
Users should avoid downloading the advertised Android application or entering OKX credentials on this site; if credentials were entered, change the password on the legitimate OKX account and enable two-factor authentication. Defenders should block fire-okx.com.cn at network perimeters, monitor for connections to that host, and add the domain to internal threat-intel feeds referencing the PhishDestroy assessment.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a168de-3084-72f3-b248-df8520549213/
Cloudflare Radar report: https://radar.cloudflare.com/scan/d467e1ec-8ccd-477d-9355-11b92a1b5cb3
URLQuery report: https://urlquery.net/report/9aa87ca0-dec1-4afe-9689-ea43ce2da98a
Stored capture screenshot: https://i.ibb.co/VcgJH7pY/c87965c33884.png
Cloudflare Radar screenshot: https://screenshots.phishdestroy.io/cf/d467e1ec-8ccd-477d-9355-11b92a1b5cb3.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/9aa87ca0-dec1-4afe-9689-ea43ce2da98a.png
URLScan screenshot (2026-10-23T13:06:55Z): https://screenshots.phishdestroy.io/us/01a168de-fb72-7630-b1a5-9c16d9da73ba.png
URLScan capture report: https://urlscan.io/result/01a168de-fb72-7630-b1a5-9c16d9da73ba/
VirusTotal report: https://www.virustotal.com/gui/domain/fire-okx.com.cn
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=fire-okx.com.cn
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 13:40:34 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/VcgJH7pY/c87965c33884.png
  Captured: 2026-10-23 13:06:50 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a168de-3084-72f3-b248-df8520549213.png
  Captured: 2026-10-23 13:06:50 UTC
  Source report: https://urlscan.io/result/01a168de-3084-72f3-b248-df8520549213/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d467e1ec-8ccd-477d-9355-11b92a1b5cb3.png
  Captured: 2026-10-23 13:39:18 UTC
  Source report: https://radar.cloudflare.com/scan/d467e1ec-8ccd-477d-9355-11b92a1b5cb3
  SHA-256: 9c71a609d2a9814a22c566de7d4fef4eb43188a873bc355018586ee76e5992f8
- URLQuery: https://screenshots.phishdestroy.io/uq/9aa87ca0-dec1-4afe-9689-ea43ce2da98a.png
  Source report: https://urlquery.net/report/9aa87ca0-dec1-4afe-9689-ea43ce2da98a
  SHA-256: 37d476111bf4ce2acadfb04cc6ab053b0846469a060f0d4ec9fa7e99596d5543
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a168de-fb72-7630-b1a5-9c16d9da73ba.png
  Captured: 2026-10-23 13:06:55 UTC
  Source report: https://urlscan.io/result/01a168de-fb72-7630-b1a5-9c16d9da73ba/
  SHA-256: 3844ab81cb09752f36562a00d0bda845057ea468608d2c56c7b06c85d17f8b09

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T14:41:58Z",
        "uuid": "01a168de-3084-72f3-b248-df8520549213",
        "scanned_at": "2026-10-23T13:06:01Z",
        "final_url": "https://fire-okx.com.cn/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://fire-okx.com.cn/",
                "from": "http://fire-okx.com.cn/",
                "status": 307
            }
        ],
        "ip": "23.231.153.34",
        "ips": [
            "23.231.153.34"
        ],
        "asns": [
            "132839"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "1a231c6b6b12fd53cccd3370a6004a3f5ad6ee15a18aa3870cf7e233c8a3e4c8",
        "tls": {
            "san": [
                "fire-okx.com.cn"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "LiteSSL RSA CA 2025",
            "subject": "fire-okx.com.cn",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-19T04:59:59Z",
            "valid_from": "2026-10-21T05:00:00Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 2,
        "tls_valid_days": 89,
        "requests": 3,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "okx"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "OKX"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T14:53:03Z",
        "uuid": "d467e1ec-8ccd-477d-9355-11b92a1b5cb3",
        "scanned_at": "2026-10-23T13:39:18Z",
        "final_url": "https://fire-okx.com.cn/",
        "status": 200,
        "history": [
            {
                "url": "https://fire-okx.com.cn/",
                "status": 200
            }
        ],
        "dom_hash": "4984284efe09a33c853f530f9a48b5cdb3ee03050d66e01e68419375346381a0",
        "doc_hash": "1a231c6b6b12fd53cccd3370a6004a3f5ad6ee15a18aa3870cf7e233c8a3e4c8",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "fire-okx.com.cn",
                "type": "A",
                "value": "23.231.153.34"
            }
        ],
        "dnssec_valid": false,
        "ip": "23.231.153.34",
        "whois": {
            "registrar": "Web Commerce Communications Limited",
            "created": "2026-10-15T14:20:48Z",
            "expires": "2027-10-15T14:20:48Z",
            "nameservers": [
                "ns1.julydns.com",
                "ns2.julydns.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T13:39:11Z",
        "analysis_at": "2026-10-21T08:22:13Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "first_seen": "2026-10-21T08:22:13Z",
        "dns": [
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "master.jmdns.com",
                "value": "ns1.julydns.com"
            },
            {
                "ttl": 100,
                "type": "A",
                "value": "23.231.153.34"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.julydns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.julydns.com"
            }
        ],
        "dns_at": "2026-10-21T08:23:19Z",
        "jarm": "3fd3fd0003fd3fd00042d42d0000002059a3b916699461c5923779b77cf06b",
        "cert": {
            "san": [
                "fire-okx.com.cn"
            ],
            "issuer": "TrustAsia Technologies, Inc. / LiteSSL RSA CA 2025",
            "serial": "42e1f4238852d6eccac54739078837d758dbd60c",
            "sha256": "2350cce09c1b2565978a2ee1114c2784ad3d7b4f1e3d38a227280e6534a1a883",
            "subject": "fire-okx.com.cn",
            "valid_to": "2027-01-19T04:59:59Z",
            "valid_from": "2026-10-21T05:00:00Z"
        },
        "whois": {
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.julydns.com",
                "ns2.julydns.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T13:40:06Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "fire-okx.com.cn"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-23T13:08:49Z",
            "first": "2026-10-23T13:08:49Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 10124
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://fire-okx.com.cn/sitemap-index.xml",
                "https://fire-okx.com.cn/sitemap-download.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 1
        },
        "social_tags": {
            "ogUrl": "https://fire-okx.com.cn/",
            "title": "欧易OKX官网 - okx安卓 - 欧易",
            "author": "欧易 OKX 官网",
            "ogType": "website",
            "robots": "index,follow,max-image-preview:large,max-snippet:-1",
            "ogImage": "https://fire-okx.com.cn/og-fire.svg",
            "ogTitle": "欧易OKX官网 - okx安卓版 - 欧易",
            "keywords": "欧易OKX官网,okx安卓版,欧易交易所,欧易安卓版下载,注册开户",
            "ogSiteName": "欧易 OKX 官网",
            "themeColor": "#05070A",
            "description": "欧易OKX官网把 okx 安卓版的取包入口与品牌底细安放在同一处，安装包现为 v6.92.0，体积 168MB，机器需 Android 6.0 或更高，2026 年 9 月 18 日发布，开户持手机号或邮箱即可办理。",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://fire-okx.com.cn/",
            "ogDescription": "okx 安卓版取包入口与品牌底细安放在同一处，v6.92.0，168MB。"
        },
        "trackers": {
            "requests": 1
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 171,
                "tls": 262,
                "wait": 516,
                "connect": 258,
                "download": 0
            },
            "response_ms": 1207
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 30397,
            "co2_grams": 0.0011,
            "cleaner_than": 48
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.48.223",
                    "host": "ns1.julydns.com"
                },
                {
                    "ip": "162.159.27.251",
                    "host": "ns2.julydns.com"
                }
            ],
            "zone": "fire-okx.com.cn"
        },
        "location": {
            "ip": "23.231.153.34",
            "asn": "132839",
            "org": "POWER LINE (HK) CO., LIMITED",
            "city": "Tin Shui Wai",
            "country": "HK"
        },
        "ssl": {
            "issuer": "TrustAsia Technologies, Inc. / LiteSSL RSA CA 2025",
            "subject": "fire-okx.com.cn"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "23.231.153.34",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://fire-okx.com.cn"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Nginx",
                "HSTS",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "internal_count": 9
        },
        "whois": {
            "registrar": "Web Commerce Communications Limited",
            "created": "2026-10-15T12:20:48Z",
            "expires": "2027-10-15T12:20:48Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.julydns.com",
                "ns2.julydns.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```