# PhishDestroy domain threat record: oes-okx.com.cn

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/oes-okx.com.cn/
Machine-readable companion: https://phishdestroy.io/domain/oes-okx.com.cn/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-20 22:53:52 UTC
- Last availability or vendor check: 2026-10-22 10:29:58 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: OKX

## Stored infrastructure

- Observed IP address: 177.4.10.59
- Registrar in stored WHOIS data: Web Commerce Communications Limited
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a15b84-aa45-750a-b057-ea42284848a5/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/oes-okx.com.cn
- Certificate Transparency search: https://crt.sh/?q=%25.oes-okx.com.cn
- Web Archive lookup: https://web.archive.org/web/*/https://oes-okx.com.cn/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed oes-okx.com.cn as malicious after an admin report combined with an AI phishing assessment that assigned 100 % confidence because the recorded page title uses the OKX brand. The domain was first observed by PhishDestroy on 2026-10-21, returning HTTP 200 for the domain with no cross-site redirect and showing the title “欧易 OKX 数据终端 - 欧易行情数据面板 | 数字资产分析工具”.

How the scam works
Impersonation scams copy the name and visual branding of a legitimate exchange to convince visitors to enter login credentials or approve wallet connections. A fake “OKX Data Terminal” can be used to harvest authentication data or to lure users into sending funds to attacker-controlled wallets under the pretense of market data tools.

Evidence
VirusTotal scanned the domain on 2026-10-21 with 92 engines and reported zero detections, while Google Safe Browsing checked the same day and did not flag the site. External blocklists MetaMask and SEAL listed the domain (2 listings) on 2026-10-21, and OTX recorded four pulses referencing it on that date. urlscan.io captured the site on 2026-10-21 and its machine‑learning engine labeled it malicious with a score of 100, categorising it as phishing and tagging the OKX brand, and PhishDestroy’s internal blocklist also marks the domain as malicious as of the same date.

Infrastructure
The recorded IP address for the site is 177.4.10.59 and the page was served by Nginx with HSTS, HTTP/3 and Open Graph metadata. Cloudflare Radar flagged the .cn domain as newly seen and noted security‑risk tags, but no registrar or certificate details are available.

What to do
Visitors should not enter any OKX credentials or approve wallet connections on this site; if they have, they should change their OKX password and monitor the account for unauthorized activity. Defenders should block the exact domain oes-okx.com.cn and review any access logs for traffic to that address.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a15b84-aa45-750a-b057-ea42284848a5/
VirusTotal report: https://www.virustotal.com/gui/domain/oes-okx.com.cn
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=oes-okx.com.cn
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-21 01:11:30 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/n83rNF2c/932fdde6b944.png
  Captured: 2026-10-20 22:53:52 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a15b84-aa45-750a-b057-ea42284848a5.png
  Captured: 2026-10-20 22:53:52 UTC
  Source report: https://urlscan.io/result/01a15b84-aa45-750a-b057-ea42284848a5/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/719fd1b3-8009-45e9-b444-80b44b92f32c.png
  Captured: 2026-10-20 22:54:25 UTC
  Source report: https://radar.cloudflare.com/scan/719fd1b3-8009-45e9-b444-80b44b92f32c
  SHA-256: aca99caf1cc161e2953e6fb02671a0ab8dec59ba3ea7ee7f7402840fd0097611
- URLQuery: https://screenshots.phishdestroy.io/uq/63e89293-00fc-4fd4-aeb8-1ac580e88bbb.png
  Source report: https://urlquery.net/report/63e89293-00fc-4fd4-aeb8-1ac580e88bbb
  SHA-256: 6f6beb58e4cb5724918124d59e1dbdbb09d4d1058b7d74bd107a2c2cae2bc40f
- URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a15b7f-02b8-726b-99dc-1376b6a278a1.png
  Captured: 2026-10-20 22:46:59 UTC
  Source report: https://urlscan.io/result/01a15b7f-02b8-726b-99dc-1376b6a278a1/
  SHA-256: f1ad5a9e5a67b1e705de0670fd123fdacce9d7a3497bdbc4ff1fce406af7d644

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T23:37:04Z",
        "uuid": "01a15b84-aa45-750a-b057-ea42284848a5",
        "scanned_at": "2026-10-20T22:53:09Z",
        "final_url": "https://oes-okx.com.cn/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://oes-okx.com.cn/",
                "from": "http://oes-okx.com.cn/",
                "status": 307
            }
        ],
        "ip": "177.4.10.59",
        "ips": [
            "177.4.10.59"
        ],
        "asns": [
            "140227"
        ],
        "countries": [
            "HK"
        ],
        "link_domains": [
            "www.toprvkxwhpm.com",
            "www.mitnpkwxvfr.net"
        ],
        "doc_hash": "4a32ee56fb3cdecbf8db1e5ae5e6bbb5b9f46175df418525378550009f4a741d",
        "script_hashes": [
            "5e593b09082f9373dd5c13c28bf88645d6e0fff6c45978f3a11aca7a0be409a9"
        ],
        "tls": {
            "san": [
                "oes-okx.com.cn",
                "www.oes-okx.com.cn"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR2",
            "subject": "oes-okx.com.cn",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-18T04:03:39Z",
            "valid_from": "2026-10-20T04:03:40Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "okx"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "OKX"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T23:37:06Z",
        "uuid": "719fd1b3-8009-45e9-b444-80b44b92f32c",
        "scanned_at": "2026-10-20T22:54:25Z",
        "final_url": "https://oes-okx.com.cn/",
        "status": 200,
        "history": [
            {
                "url": "https://oes-okx.com.cn/",
                "status": 200
            }
        ],
        "dom_hash": "e0a24b0eeae41c7d100ae03109f9396fd177fcfb63a52b31b5a849fadc90d52c",
        "doc_hash": "4a32ee56fb3cdecbf8db1e5ae5e6bbb5b9f46175df418525378550009f4a741d",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "oes-okx.com.cn",
                "type": "A",
                "value": "177.4.10.59"
            }
        ],
        "dnssec_valid": false,
        "ip": "177.4.10.59",
        "whois": {
            "registrar": "Web Commerce Communications Limited",
            "created": "2026-10-20T12:34:10Z",
            "expires": "2027-10-20T12:34:10Z",
            "nameservers": [
                "a7.share-dns.com",
                "b7.share-dns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T01:07:40Z",
        "analysis_at": "2026-10-20T23:35:34Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 39
        },
        "reputation": 0,
        "first_seen": "2026-10-20T05:14:29Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "a.share-dns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "b.share-dns.net"
            },
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "master.share-dns.com",
                "value": "a.share-dns.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "177.4.10.59"
            }
        ],
        "dns_at": "2026-10-20T23:41:05Z",
        "jarm": "3fd3fd0003fd3fd00042d42d0000002059a3b916699461c5923779b77cf06b",
        "cert": {
            "san": [
                "oes-okx.com.cn",
                "www.oes-okx.com.cn"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "528a9cf6226b05babf19f38151835e3d1df",
            "sha256": "8258cd7b7200193af06bc3c10d3e0b32875566662a58a9933b6ffe4a961535fd",
            "subject": "oes-okx.com.cn",
            "valid_to": "2027-01-18T04:03:39Z",
            "valid_from": "2026-10-20T04:03:40Z"
        },
        "whois": {
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "a7.share-dns.com",
                "b7.share-dns.net"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-20T23:32:25Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "oes-okx.com.cn"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-20T22:55:05Z",
            "first": "2026-10-20T22:55:05Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 5377
        },
        "social_tags": {
            "title": "欧易 OKX 数据终端 - 欧易行情数据面板 | 数字资产分析工具",
            "author": "欧易 OKX",
            "ogType": "website",
            "robots": "index, follow",
            "ogImage": "https://oes-okx.com.cn/assets/og-cover.svg",
            "ogTitle": "欧易 OKX 数据终端 - 欧易行情数据面板 | 数字资产分析工具",
            "keywords": "欧易,欧易 OKX,数据终端,行情数据,行情矩阵,交易知识库,风险揭示,数字资产",
            "ogSiteName": "欧易 OKX",
            "themeColor": "#0a1022",
            "description": "欧易 OKX 数据终端把行情矩阵、交易知识库与风险揭示收进同一面板。欧易用户可用它查看多市场数据、学习指标含义，并建立理性的风险认知。",
            "ogDescription": "行情矩阵、交易知识库与风险揭示收进同一面板，帮欧易用户读懂数字资产市场。"
        },
        "trackers": {
            "requests": 3
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 11,
                "tls": 205,
                "wait": 403,
                "connect": 201,
                "download": 0
            },
            "response_ms": 820
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 16522,
            "co2_grams": 0.0006,
            "cleaner_than": 61
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.53.25",
                    "host": "a.share-dns.com"
                },
                {
                    "ip": "162.159.27.88",
                    "host": "b.share-dns.net"
                }
            ],
            "zone": "oes-okx.com.cn"
        },
        "location": {
            "ip": "177.4.10.59",
            "asn": "140227",
            "org": "Hong Kong Communications International Co., Limited",
            "city": "Hong Kong",
            "country": "HK"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR2",
            "subject": "oes-okx.com.cn"
        },
        "dns": {
            "A": [
                "177.4.10.59"
            ],
            "NS": [
                "a.share-dns.com",
                "b.share-dns.net"
            ],
            "SOA": "{\"nsname\": \"a.share-dns.com\", \"hostmaster\": \"master.share-dns.com\", \"serial\": 1792471108, \"refresh\": 3600, \"retry\": 1200, \"expire\": 86400, \"minttl\": 600}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "177.4.10.59",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://oes-okx.com.cn"
            ]
        },
        "subdomains": {
            "count": 2,
            "subdomains": [
                "cn.oes-okx.com.cn",
                "www.oes-okx.com.cn"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Nginx",
                "HSTS",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "external": [
                "https://www.mitnpkwxvfr.net/zh-hans/join",
                "https://www.toprvkxwhpm.com/upgradeapp/android_ACE532512.apk"
            ],
            "external_count": 2,
            "internal_count": 5
        },
        "whois": {
            "registrar": "Web Commerce Communications Limited",
            "created": "2026-10-20T10:34:10Z",
            "expires": "2027-10-20T10:34:10Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "a7.share-dns.com",
                "b7.share-dns.net"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```