# memo-okx.com.cn: Recorded OKX-branded digital asset platform page | PhishDestroy

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/memo-okx.com.cn/
Machine-readable companion: https://phishdestroy.io/domain/memo-okx.com.cn/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: Last known active
- First observed by PhishDestroy: 2026-11-04 22:54:23 UTC
- Selected availability observation: 2026-11-05T00:12:25Z
- Stored record updated: 2026-11-05 00:12:25 UTC
- VirusTotal detections in the stored snapshot: 3/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: checked_clean

## Stored labels and detections

- Automated brand label (collector metadata; not a confirmed impersonation finding): OKX

## Stored infrastructure

- Observed IP address: 104.21.39.73
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 301 (observed: 2026-11-05T00:12:25Z)
- Registration date in stored WHOIS data: 2026-10-29 13:31:23 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1a8c3-6bf5-713e-bd1e-a84d4fc33ff1/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/memo-okx.com.cn
- Certificate Transparency search: https://crt.sh/?q=%25.memo-okx.com.cn
- Web Archive lookup: https://web.archive.org/web/*/https://memo-okx.com.cn/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Public report package

PhishDestroy records memo-okx.com.cn as a page presenting an OKX-branded digital asset platform with download and registration prompts.

On 2026-11-04, memo-okx.com.cn served a Chinese-language page branded as "欧易 OKX" (OKX), presenting itself as a comprehensive digital asset service platform. The hero section pairs a headline naming the exchange with a description of integrated market data, trading, asset management and risk tools, alongside buttons labeled "立即下载 App" (Download App) and "立即注册" (Register Now). A dark panel illustrates multi-market charting with spot and futures, depth charts and an asset dashboard.

The stored VirusTotal domain result reports 3 detections out of 92 engines. CRDF reported "malicious"; Gridinsoft reported "suspicious".
Package revision: 6cdbe6cca312f28f423fa7a79bd5eb3aee2a4c757dc425459c936350330725c0
Text generated (not scan time): 2026-11-05 00:34:43
Reviewed evidence snapshot: {"domain":"memo-okx.com.cn","screenshot_available":true,"capture_contract":"verified-capture-20261102","plain_text_contract":1,"capture_context":{"submitted_host":"memo-okx.com.cn","final_host":"memo-okx.com.cn","redirects":[{"to":"https://memo-okx.com.cn/","from":"http://memo-okx.com.cn/","status":307},{"to":"https://memo-okx.com.cn/zh-hans/zh/web/index.html","from":"https://memo-okx.com.cn/","status":301}],"captured_at":"2026-11-04T22:52:28.840000Z","uuid":"01a1a8c3-6bf5-713e-bd1e-a84d4fc33ff1","report_url":"https://urlscan.io/result/01a1a8c3-6bf5-713e-bd1e-a84d4fc33ff1/","sha256":"309a9fa14e5ab71754a0de652dd6010b4cc7a5af9387e5506a91550b9530d065","relationship":"own_domain_page"},"redirect_text_policy":"explicit-redirect-v1","initial_ai_description":"The website impersonates the cryptocurrency exchange OKX, using its name and branding in the page title and text, while operating on a domain (memo-okx.com.cn) that is not the official OKX domain. The content describes features of a crypto exchange and encourages downloads and registration, indicating an attempt to phish credentials or facilitate a crypto drain.","initial_ai_description_kind":"unverified previous AI opinion","virustotal":{"scope":"domain","detections":3,"engines":92,"malicious":2,"suspicious":1,"analysis_date":"2026-11-02","retrieved_date":"2026-11-05","vendor_labels":{"CRDF":"malicious","Gridinsoft":"suspicious","alphaMountain.ai":"phishing"},"flagging_vendors":["CRDF","Gridinsoft","alphaMountain.ai"]},"virustotal_public_summary":"The stored VirusTotal domain result reports 3 detections out of 92 engines. CRDF reported \"malicious\"; Gridinsoft reported \"suspicious\".","page_paragraph_target_characters":542}
Source facts (timestamps as stored): {"record_id":1794806,"first_recorded_at":"2026-11-04 23:54:23","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":3,"denominator":92,"malicious":2,"suspicious":1,"vendors":{"CRDF":"malicious","Gridinsoft":"suspicious","alphaMountain.ai":"phishing"},"observed_at":"2026-11-02T20:06:18Z","checked_at":null,"fetched_at":"2026-11-04T23:31:50Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":3,"denominator":92,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","CRDF","Gridinsoft"],"observed_at":"2026-11-02 20:06:18","checked_at":"2026-11-05 00:31:52","fetched_at":"2026-11-04 23:31:52","time_basis":"as stored; legacy timezone not established"},"record_source":"phishdestroy.technologies.vt","vendor_labels":{"CRDF":"malicious","Gridinsoft":"suspicious","alphaMountain.ai":"phishing"},"vendor_names":["CRDF","Gridinsoft","alphaMountain.ai"],"stats":{"timeout":0,"harmless":52,"malicious":2,"suspicious":1,"undetected":37}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-11-05 00:32:28"},"spamhaus":{"source":"Spamhaus","verdict":"DBL_PHISH","checked_at":"2026-11-05 00:30:31"},"availability":{"state":"alive","label_key":"availability.active","detail_key":"detail.latest_reachability","params":[],"source":"current_http_probe","record_id":1794806,"scope":"checked_url","observed_at":"2026-11-05T00:12:25Z","http_status":301,"http_observed_at":"2026-11-05T00:12:25Z","stored_http_code":301,"stored_http_observed_at":"2026-11-05T00:12:25Z","legacy_site_status":"alive","supports_outcome_badge":false,"content_classification":"unknown","content_classification_at":null,"registration_state":"unknown","policy":"20261102-dated-availability-v2"}}

## Stored page captures

- URLScan · 2026-11-04: https://screenshots.phishdestroy.io/us/01a1a8c3-6bf5-713e-bd1e-a84d4fc33ff1.png
  Captured: 2026-11-04 22:52:28 UTC
  Source report: https://urlscan.io/result/01a1a8c3-6bf5-713e-bd1e-a84d4fc33ff1/
  SHA-256: 309a9fa14e5ab71754a0de652dd6010b4cc7a5af9387e5506a91550b9530d065
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6802dba0-6e81-42c8-86bb-85ab8d0519b9.png
  Captured: 2026-11-04 22:57:13 UTC
  Source report: https://radar.cloudflare.com/scan/6802dba0-6e81-42c8-86bb-85ab8d0519b9
  SHA-256: f83e69b45ee687806d9f5d8932c9164be1c906305eb74b79407b1312c27b8c27
- URLQuery: https://screenshots.phishdestroy.io/uq/1f6117dd-c17e-4a75-b122-391ad7d067cd.png
  Source report: https://urlquery.net/report/1f6117dd-c17e-4a75-b122-391ad7d067cd
  SHA-256: 411aba88338e8d2e2df111aa067e216f965ec788d0a6ecbd51b1f8b67b29a62b

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-11-04T22:59:01Z",
        "uuid": "01a1a8c3-6bf5-713e-bd1e-a84d4fc33ff1",
        "scanned_at": "2026-11-04T22:52:28Z",
        "final_url": "https://memo-okx.com.cn/zh-hans/zh/web/index.html",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://memo-okx.com.cn/",
                "from": "http://memo-okx.com.cn/",
                "status": 307
            },
            {
                "to": "https://memo-okx.com.cn/zh-hans/zh/web/index.html",
                "from": "https://memo-okx.com.cn/",
                "status": 301
            }
        ],
        "ip": "172.67.143.167",
        "domains": [
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "104.16.80.73",
            "172.67.143.167"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.mithvxrqkpn.com",
            "www.topfgcnzqwl.net",
            "www.memo-okx.com.cn",
            "zh.memo-okx.com.cn",
            "cn.memo-okx.com.cn",
            "zhcn.memo-okx.com.cn",
            "web.memo-okx.com.cn",
            "app.memo-okx.com.cn",
            "home.memo-okx.com.cn",
            "btc.memo-okx.com.cn",
            "boot.memo-okx.com.cn",
            "deriv.memo-okx.com.cn",
            "c2c.memo-okx.com.cn",
            "p2p.memo-okx.com.cn",
            "web3.memo-okx.com.cn",
            "earn.memo-okx.com.cn",
            "wallet.memo-okx.com.cn",
            "market.memo-okx.com.cn",
            "trade.memo-okx.com.cn"
        ],
        "doc_hash": "250b7205c68b2c438c04bc7cddb179aed81d7e7cf6cdf5f6cb142a476c1096bf",
        "globals": [
            "__cfBeacon"
        ],
        "tls": {
            "san": [
                "*.memo-okx.com.cn",
                "memo-okx.com.cn"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "memo-okx.com.cn",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-27T13:45:23Z",
            "valid_from": "2026-10-29T13:45:24Z"
        },
        "domain_age_days": 3,
        "apex_age_days": 3,
        "tls_age_days": 6,
        "tls_valid_days": 89,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-2aab354"
                ],
                "score": 81,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-11-04T22:59:22Z",
        "uuid": "6802dba0-6e81-42c8-86bb-85ab8d0519b9",
        "scanned_at": "2026-11-04T22:57:13Z",
        "final_url": "https://memo-okx.com.cn/zh-hans/zh/web/index.html",
        "status": 200,
        "redirected": "same-domain",
        "history": [
            {
                "url": "https://memo-okx.com.cn/",
                "status": 301
            },
            {
                "url": "https://memo-okx.com.cn/zh-hans/zh/web/index.html",
                "status": 200
            }
        ],
        "dom_hash": "9a6ba636208bfc69dcd73a8125ad2a64e58d6cde346fefd8bf39288b2aa4b2c1",
        "doc_hash": "250b7205c68b2c438c04bc7cddb179aed81d7e7cf6cdf5f6cb142a476c1096bf",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "memo-okx.com.cn",
                "type": "A",
                "value": "104.21.39.73"
            },
            {
                "name": "memo-okx.com.cn",
                "type": "A",
                "value": "172.67.143.167"
            },
            {
                "name": "memo-okx.com.cn",
                "type": "AAAA",
                "value": "2606:4700:3031::6815:2749"
            },
            {
                "name": "memo-okx.com.cn",
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:8fa7"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.2",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-10-29T14:31:23Z",
            "expires": "2027-10-29T14:31:23Z",
            "nameservers": [
                "sam.ns.cloudflare.com",
                "brenda.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-11-04T23:31:50Z",
        "analysis_at": "2026-11-02T20:06:18Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 2,
            "suspicious": 1,
            "undetected": 37
        },
        "detections": {
            "CRDF": "malicious",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Webroot": "Phishing and Other Frauds",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "newly registered websites"
        },
        "first_seen": "2026-10-29T14:48:47Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.143.167"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:8fa7"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "brenda.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.39.73"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::6815:2749"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "brenda.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "sam.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-11-02T20:06:38Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.memo-okx.com.cn",
                "memo-okx.com.cn"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "50fa52c19404eb5904dca2a088127031758",
            "sha256": "61a382537e54d45ca85c0ff8bc48f4d1ee508e86841112fafe05f8f3a34aa226",
            "subject": "memo-okx.com.cn",
            "valid_to": "2027-01-27T13:45:23Z",
            "valid_from": "2026-10-29T13:45:24Z"
        },
        "whois": {
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "brenda.ns.cloudflare.com",
                "sam.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-11-04T22:59:39Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://memo-okx.com.cn/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 6
        },
        "social_tags": {
            "ogUrl": "https://memo-okx.com.cn/zh-hans/zh/web/index.html",
            "title": "欧易 · OKX · 欧易交易所",
            "ogType": "website",
            "robots": "index, follow",
            "ogTitle": "欧易 · OKX · 欧易交易所",
            "ogSiteName": "欧易 OKX",
            "description": "欧易 OKX 品牌首页，了解平台定位、核心功能与使用方式，涵盖交易、行情、资产管理与安全机制。",
            "twitterCard": "summary",
            "canonicalUrl": "https://memo-okx.com.cn/zh-hans/zh/web/index.html",
            "ogDescription": "欧易 OKX 品牌首页，了解平台定位、核心功能与使用方式，涵盖交易、行情、资产管理与安全机制。"
        },
        "trackers": {
            "requests": 1
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 301,
            "timings": {
                "dns": 708,
                "tls": 42,
                "wait": 963,
                "connect": 16,
                "download": 0
            },
            "response_ms": 1729
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 27996,
            "co2_grams": 0.001,
            "cleaner_than": 49
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "173.245.58.77",
                    "host": "brenda.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.193.141",
                    "host": "sam.ns.cloudflare.com"
                }
            ],
            "zone": "memo-okx.com.cn"
        },
        "location": {
            "ip": "2606:4700:3031::6815:2749",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "memo-okx.com.cn"
        },
        "dns": {
            "A": [
                "172.67.143.167",
                "104.21.39.73"
            ],
            "NS": [
                "brenda.ns.cloudflare.com",
                "sam.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"brenda.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418781256, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3031::6815:2749",
                "2606:4700:3034::ac43:8fa7"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3031::6815:2749",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://memo-okx.com.cn",
                "https://memo-okx.com.cn/zh-hans/zh/web/index.html"
            ],
            "count": 1
        },
        "linked_pages": {
            "external": [
                "https://www.mithvxrqkpn.com/upgradeapp/android_ACE532658.apk",
                "https://www.topfgcnzqwl.net/zh-hans/join",
                "https://www.memo-okx.com.cn/zh-hans/zh/web/index.html",
                "https://zh.memo-okx.com.cn/zh-hans/zh/web/index.html",
                "https://cn.memo-okx.com.cn/zh-hans/zh/web/index.html",
                "https://zhcn.memo-okx.com.cn/zh-hans/zh/web/index.html",
                "https://web.memo-okx.com.cn/zh-hans/zh/web/index.html",
                "https://app.memo-okx.com.cn/zh-hans/zh/web/index.html",
                "https://home.memo-okx.com.cn/zh-hans/zh/web/index.html",
                "https://btc.memo-okx.com.cn/zh-hans/zh/web/index.html",
                "https://boot.memo-okx.com.cn/zh-hans/zh/web/index.html",
                "https://deriv.memo-okx.com.cn/zh-hans/zh/web/index.html",
                "https://c2c.memo-okx.com.cn/zh-hans/zh/web/index.html",
                "https://p2p.memo-okx.com.cn/zh-hans/zh/web/index.html",
                "https://web3.memo-okx.com.cn/zh-hans/zh/web/index.html",
                "https://earn.memo-okx.com.cn/zh-hans/zh/web/index.html",
                "https://wallet.memo-okx.com.cn/zh-hans/zh/web/index.html",
                "https://market.memo-okx.com.cn/zh-hans/zh/web/index.html",
                "https://trade.memo-okx.com.cn/zh-hans/zh/web/index.html"
            ],
            "external_count": 19,
            "internal_count": 8
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-10-29T13:31:23Z",
            "expires": "2027-10-29T12:31:23Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "sam.ns.cloudflare.com",
                "brenda.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8"
            }
        }
    }
}
```
Capture recorded with this analysis (source URL, capture time and stored hash): {"url":"https://screenshots.phishdestroy.io/us/01a1a8c3-6bf5-713e-bd1e-a84d4fc33ff1.png","source":"URLScan","report_url":"https://urlscan.io/result/01a1a8c3-6bf5-713e-bd1e-a84d4fc33ff1/","captured_at":"2026-11-04T22:52:28Z","sha256":"309a9fa14e5ab71754a0de652dd6010b4cc7a5af9387e5506a91550b9530d065","model_image_sha256":"544c7e03c61757a2b4c34715a8f5cb247188dfbc41d1f4070f12803cae93523f","available":true,"content_status":null}

## Complete dated records
Availability observations: https://phishdestroy.io/domain/memo-okx.com.cn/records.json?source=availability&format=json
Source observation history: https://phishdestroy.io/domain/memo-okx.com.cn/records.json?source=detections&format=json
PhishStats records: https://phishdestroy.io/domain/memo-okx.com.cn/records.json?source=phishstats&format=json
Sent report records: https://phishdestroy.io/domain/memo-okx.com.cn/records.json?source=sent_reports&format=json
Report history: https://phishdestroy.io/domain/memo-okx.com.cn/records.json?source=report_history&format=json
Repeat report records: https://phishdestroy.io/domain/memo-okx.com.cn/records.json?source=rereports&format=json
Follow-up records: https://phishdestroy.io/domain/memo-okx.com.cn/records.json?source=followups&format=json
Content observations: https://phishdestroy.io/domain/memo-okx.com.cn/records.json?source=content&format=json

## Dated availability observation
Latest stored reachability observation
```json
{
    "state": "alive",
    "label_key": "availability.active",
    "detail_key": "detail.latest_reachability",
    "params": [],
    "source": "current_http_probe",
    "record_id": 1794806,
    "scope": "checked_url",
    "observed_at": "2026-11-05T00:12:25Z",
    "http_status": 301,
    "http_observed_at": "2026-11-05T00:12:25Z",
    "stored_http_code": 301,
    "stored_http_observed_at": "2026-11-05T00:12:25Z",
    "legacy_site_status": "alive",
    "supports_outcome_badge": false,
    "content_classification": "unknown",
    "content_classification_at": null,
    "registration_state": "unknown",
    "policy": "20261102-dated-availability-v2"
}
```