# PhishDestroy domain threat record: okex-app.hl.cn

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/okex-app.hl.cn/
Machine-readable companion: https://phishdestroy.io/domain/okex-app.hl.cn/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-20 22:50:33 UTC
- Last availability or vendor check: 2026-10-22 10:29:54 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 7/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: OKX

## Stored infrastructure

- Observed IP address: 82.41.66.136
- Registrar in stored WHOIS data: 万商云集（成都）科技股份有限公司
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-12 11:33:47 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a15b81-ac95-74ad-9f04-d686c21da104/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/okex-app.hl.cn
- Certificate Transparency search: https://crt.sh/?q=%25.okex-app.hl.cn
- Web Archive lookup: https://web.archive.org/web/*/https://okex-app.hl.cn/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy has added okex-app.hl.cn to its internal blocklist as a suspicious domain. The recorded page title is “欧易 OKX 官网”. The domain was first seen by PhishDestroy on 2026-10-21.

How the scam works
The listing and detections do not confirm a specific malicious mechanism. Because the site mimics the OKX brand, it could be used in typical brand‑impersonation attacks, but no concrete behavior was observed on the page.

Evidence
VirusTotal returned 7 detections out of 92 engines on 2026-10-21 (analysis performed 2026-10-19) with vendors alphaMountain.ai, CRDF, Emsisoft, Fortinet, Gridinsoft, Netcraft and Webroot. Google Safe Browsing checked the domain on 2026-10-21 and reported it as not flagged. External blocklists showed zero hits on 2026-10-20, while PhishDestroy’s internal list marked the domain as suspicious on 2026-10-20. OTX had no pulses referencing the domain as of 2026-10-21.

Infrastructure
The recorded hosting IP for okex-app.hl.cn is 82.41.66.136. No additional registration or CDN details are available, and the listing applies only to this exact address.

What to do
If you visited the site but did not submit any credentials, no immediate action is required beyond routine vigilance. If you entered login information, change the associated passwords and enable any available two‑factor authentication. Defenders should block traffic to okex-app.hl.cn in firewalls and monitor logs for any connections to the recorded IP.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a15b81-ac95-74ad-9f04-d686c21da104/
VirusTotal report: https://www.virustotal.com/gui/domain/okex-app.hl.cn
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=okex-app.hl.cn
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-20 22:51:25 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/Df6MYw3B/2fed2c46d7e0.png
  Captured: 2026-10-20 22:50:33 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a15b81-ac95-74ad-9f04-d686c21da104.png
  Captured: 2026-10-20 22:50:33 UTC
  Source report: https://urlscan.io/result/01a15b81-ac95-74ad-9f04-d686c21da104/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6a9a020f-5329-4864-818b-8e95d92e9450.png
  Captured: 2026-10-20 22:51:01 UTC
  Source report: https://radar.cloudflare.com/scan/6a9a020f-5329-4864-818b-8e95d92e9450
  SHA-256: 0edf7398149e5d37f3945f3df11ee493cf5eeaa2db5d62e52203743ef4ecc02a
- URLQuery: https://screenshots.phishdestroy.io/uq/ba82850a-ac91-470f-9d23-fc6a386252df.png
  Source report: https://urlquery.net/report/ba82850a-ac91-470f-9d23-fc6a386252df
  SHA-256: 1944c5b2d4012ac237ac657b10774cfd2d93bb511781e985ba605e4d4a7b79ef
- URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a15b77-a7bb-7739-9323-352bd2e907df.png
  Captured: 2026-10-20 22:38:58 UTC
  Source report: https://urlscan.io/result/01a15b77-a7bb-7739-9323-352bd2e907df/
  SHA-256: a2d912d8ddf946e61ce4d6819017357393eaf49b2cb6623478b0ff7feeab6646
- URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a15b7b-23d9-73da-a959-12ccf69d5c60.png
  Captured: 2026-10-20 22:42:46 UTC
  Source report: https://urlscan.io/result/01a15b7b-23d9-73da-a959-12ccf69d5c60/
  SHA-256: c60bc26d231fa2828fba6cb7c729ddc71f11630150852b368c9b15d09829d510
- URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a15b7c-1bfa-74be-b85c-d613d8ae3acd.png
  Captured: 2026-10-20 22:43:49 UTC
  Source report: https://urlscan.io/result/01a15b7c-1bfa-74be-b85c-d613d8ae3acd/
  SHA-256: 1b2d3e6594e61763eeccb1e50b6af9d1303e156b19b0ce4551a901dde0fdce6c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T23:43:30Z",
        "uuid": "01a15b81-ac95-74ad-9f04-d686c21da104",
        "scanned_at": "2026-10-20T22:49:53Z",
        "final_url": "https://okex-app.hl.cn/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://okex-app.hl.cn/",
                "from": "http://okex-app.hl.cn/",
                "status": 307
            }
        ],
        "ip": "82.41.66.136",
        "domains": [
            "www.okx.com"
        ],
        "ips": [
            "172.64.144.82",
            "82.41.66.136"
        ],
        "asns": [
            "13335",
            "153656"
        ],
        "countries": [
            "HK"
        ],
        "link_domains": [
            "www.dkgwpqxvfnr.com",
            "www.mitxcqvwnhj.com"
        ],
        "doc_hash": "45c17a5716dfa00de5529771c9dd9f4bf84dc72d0a8606a4715bbf462dca23cf",
        "cookies": [
            "__cf_bm"
        ],
        "tls": {
            "san": [
                "okex-app.hl.cn"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR2",
            "subject": "okex-app.hl.cn",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-14T02:50:47Z",
            "valid_from": "2026-10-16T02:50:48Z"
        },
        "domain_age_days": 4,
        "apex_age_days": 4,
        "tls_age_days": 4,
        "tls_valid_days": 89,
        "requests": 3,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "okx"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "OKX"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:21:15Z",
        "uuid": "6a9a020f-5329-4864-818b-8e95d92e9450",
        "scanned_at": "2026-10-20T22:51:01Z",
        "final_url": "https://okex-app.hl.cn/",
        "status": 200,
        "history": [
            {
                "url": "https://okex-app.hl.cn/",
                "status": 200
            }
        ],
        "dom_hash": "d61eb5e2d17819cbb5116ef80afd041593ae2fd16db9f731606bc71a57669fa0",
        "doc_hash": "45c17a5716dfa00de5529771c9dd9f4bf84dc72d0a8606a4715bbf462dca23cf",
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "okex-app.hl.cn",
                "type": "A",
                "value": "82.41.66.136"
            }
        ],
        "dnssec_valid": false,
        "ip": "82.41.66.136",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "万商云集（成都）科技股份有限公司",
            "created": "2026-10-12T13:33:47Z",
            "expires": "2027-10-12T13:33:47Z",
            "nameservers": [
                "ns1.kenpains.com",
                "ns2.kenpains.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T00:08:24Z",
        "analysis_at": "2026-10-20T23:43:14Z",
        "stats": {
            "timeout": 0,
            "harmless": 49,
            "malicious": 6,
            "suspicious": 1,
            "undetected": 36
        },
        "detections": {
            "CRDF": "malicious",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "created": "2026-10-12T00:00:00Z",
        "first_seen": "2026-10-16T03:58:59Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.kenpains.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "82.41.66.136"
            },
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "admin.kenpains.com",
                "value": "ns1.kenpains.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.kenpains.com"
            }
        ],
        "dns_at": "2026-10-20T23:43:37Z",
        "jarm": "3fd3fd0003fd3fd21c42d42d000000bdfc58c9a46434368cf60aa440385763",
        "cert": {
            "san": [
                "okex-app.hl.cn"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "594bfba6012ca5bf9f94f291f91470bc4b",
            "sha256": "f0b6581146a02a45622af8eaaed895f4ee023ef902a613d360be7fefd8e7cc07",
            "subject": "okex-app.hl.cn",
            "valid_to": "2027-01-14T02:50:47Z",
            "valid_from": "2026-10-16T02:50:48Z"
        },
        "whois": []
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-20T23:32:36Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "okex-app.hl.cn"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-16T12:30:42Z",
            "first": "2026-10-16T12:30:42Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 10872
        },
        "social_tags": {
            "ogUrl": "https://www.okx.com/",
            "title": "欧易 OKX 官网",
            "author": "OKX",
            "ogType": "website",
            "robots": "index,follow,max-snippet:-1,max-image-preview:large",
            "ogImage": "https://www.okx.com/favicon.ico",
            "ogTitle": "欧易 OKX - 全球领先的数字资产交易平台",
            "keywords": "欧易,OKX,欧易OKX,数字资产交易平台,比特币交易,以太坊,安卓App下载,OKX注册,加密货币交易所",
            "ogSiteName": "欧易 OKX",
            "themeColor": "#000000",
            "description": "欧易 OKX 是领先的数字资产交易平台，支持比特币、以太坊等 300+ 币种的现货与衍生品交易。毫秒级撮合引擎、机构级风控体系、7×24 小时中文服务，立即注册或下载安卓 App 开启交易。",
            "twitterCard": "summary_large_image",
            "ogDescription": "支持 300+ 数字资产的现货与衍生品交易，毫秒级撮合，机构级风控，7×24 小时中文服务。"
        },
        "trackers": {
            "requests": 1
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 515,
                "tls": 188,
                "wait": 367,
                "connect": 188,
                "download": 2
            },
            "response_ms": 1260
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 35245,
            "co2_grams": 0.0013,
            "cleaner_than": 45
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "1.193.216.197",
                    "host": "ns2.kenpains.com"
                },
                {
                    "ip": "218.98.111.227",
                    "host": "ns1.kenpains.com"
                }
            ],
            "zone": "okex-app.hl.cn"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "__cf_bm",
                    "secure": true,
                    "http_only": true,
                    "same_site": "None"
                }
            ]
        },
        "location": {
            "ip": "82.41.66.136",
            "asn": "153656",
            "org": "OWGELS INTERNATIONAL CO., LIMITED",
            "city": "Hong Kong",
            "country": "HK"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR2",
            "subject": "okex-app.hl.cn"
        },
        "dns": {
            "A": [
                "82.41.66.136"
            ],
            "NS": [
                "ns2.kenpains.com",
                "ns1.kenpains.com"
            ],
            "SOA": "{\"nsname\": \"ns1.kenpains.com\", \"hostmaster\": \"admin.kenpains.com\", \"serial\": 1792122323, \"refresh\": 3600, \"retry\": 300, \"expire\": 1209600, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "82.41.66.136",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://okex-app.hl.cn"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Nginx",
                "HSTS",
                "Open Graph"
            ]
        },
        "social_presence": {
            "profiles": [
                "https://x.com/okx"
            ]
        },
        "linked_pages": {
            "external": [
                "https://www.dkgwpqxvfnr.com/upgradeapp/android_SSY2288330.apk",
                "https://www.mitxcqvwnhj.com/join/SSY2288330"
            ],
            "external_count": 2,
            "internal_count": 5
        },
        "whois": {
            "registrar": "万商云集（成都）科技股份有限公司",
            "created": "2026-10-12T11:33:47Z",
            "expires": "2027-10-12T11:33:47Z",
            "status": [
                "ok"
            ],
            "nameservers": [
                "ns1.kenpains.com",
                "ns2.kenpains.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```