# PhishDestroy threat dossier — gwoyicn.com ================================================================ Fetched: 2026-07-30 12:01:23 UTC Canonical: https://phishdestroy.io/domain/gwoyicn.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: OKX ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 16/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Google Safe Browsing, Gridinsoft, Lionic, SOCRadar, Sophos, VIPRE AlienVault OTX: 2 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist Google Safe Browsing: FLAGGED ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 47.242.161.22 (HK, Hong Kong) ASN: AS45102 Alibaba (US) Technology Co., Ltd. Hosting org: Hong Kong Registrar: Amazon Registrar, Inc. Nameservers: ["ns-1226.awsdns-25.org", "ns-1561.awsdns-03.co.uk", "ns-253.awsdns-31.com", "ns-637.awsdns-15.net"] Page title: Buy Bitcoin & Crypto | Crypto Exchange, App & Wallet | OKX Europe HTTP response: 301 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Aliyun Computing Co, Ltd. / Aliyun RSA TLS DV G1 Expires: 2026-10-13 Status: INVALID chain Fingerprint: 370be2b5331afecf790170e4ed4c33479c85dfb98c9bfe033fa3227ba6576f5b ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-26 10:23:09 UTC (by PhishDestroy tracker) Last verified: 2026-07-30 12:20:30 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-26 10:24:42 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Is gwoyicn.com a phishing site? Analysis of gwoyicn.com indicates a high‑risk, active generic phishing campaign. The domain is registered through Amazon Registrar, Inc. and resolves to four AWS name servers (ns-1226.awsdns-25.org, ns-1561.awsdns-03.co.uk, ns-253.awsdns-31.com, and an incomplete fourth entry). An HTTP 301 response is observed, suggesting the domain redirects traffic to another location, a technique commonly used to conceal malicious endpoints. VirusTotal reports that 16 of 91 security vendors have flagged the domain, providing a modest but notable detection rate. Google Safe Browsing classifies the site as a social engineering threat, reinforcing the phishing assessment. The domain is already blocked by PhishDestroy and appears on one additional security blocklist, indicating that at least some defensive feeds are aware of its malicious use. Current intelligence confirms the domain remains active as of the report date, July 26 2026, and is assigned a high risk level. No public IP address, hosting ASN, or SSL certificate details are supplied, so infrastructure attribution cannot be completed at this time. Likewise, page‑level evidence such as title or content has not been disclosed, leaving the exact lure or credential‑capture method uncertain. Defenders should prioritize immediate blocking of gwoyicn.com across network and endpoint controls, add the domain to URL filtering and email security policies, and monitor for any related C‑NAME or IP associations that may emerge. Continuous re‑evaluation is advised, as the lack of detailed hosting information may allow the operators to shift infrastructure while retaining the same domain registration. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: bd65888433c8364a8781f14adacef11c TLS cert SHA-256: 370be2b5331afecf790170e4ed4c33479c85dfb98c9bfe033fa3227ba6576f5b ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/gwoyicn.com/ JSON API: https://api.destroy.tools/v1/check?domain=gwoyicn.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,633 domains (83,358 alive under monitoring, 110,015 confirmed takedowns/dead). Site: https://phishdestroy.io