# PhishDestroy domain threat record: oru-okx.com.cn

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/oru-okx.com.cn/
Machine-readable companion: https://phishdestroy.io/domain/oru-okx.com.cn/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 03:32:07 UTC
- Last availability or vendor check: 2026-10-23 11:24:12 UTC
- Stored record updated: 2026-10-23 18:22:15 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: OKX

## Stored infrastructure

- Observed IP address: 177.4.10.96
- Registrar in stored WHOIS data: Web Commerce Communications Limited
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-20 10:34:05 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a166cf-769e-740a-a93e-2e83aa8c6f49/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/oru-okx.com.cn
- Certificate Transparency search: https://crt.sh/?q=%25.oru-okx.com.cn
- Web Archive lookup: https://web.archive.org/web/*/https://oru-okx.com.cn/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake on 2026-10-23 added oru-okx.com.cn to the internal blocklist after an admin report and an AI assessment that identified brand impersonation of OKX. The recorded page title “欧易交易所 - 欧易 OKX 专题中心 | 交易安全解读” references OKX while the domain differs from the official exchange address. The page also displayed calls to action such as “立即下载” and “立即注册,” which are typical of credential‑theft or malicious‑download schemes. An HTTP 200 response was recorded on 2026-10-23, confirming the page was reachable at that time.

How the scam works
Impersonation sites copy the visual design and terminology of legitimate cryptocurrency exchanges to lure users into entering login credentials or downloading software. By presenting urgent‑sounding buttons like “Download Now” or “Register Now,” they aim to harvest account data or install malware on the visitor’s device. Victims who provide credentials may have those accounts compromised, and downloaded files can execute malicious payloads.

Evidence
VirusTotal scanned the domain on 2026-10-23 with 92 engines and reported zero malicious or suspicious detections. Google Safe Browsing checked the same day and did not flag the URL. The external blocklists MetaMask and SEAL listed the domain, and OTX recorded three pulses referencing it as of 2026-10-23. URLScan captured the site on 2026-10-23 and assigned a malicious phishing verdict with a score of 100, tagging the OKX brand. PhishDestroy’s internal blocklist also marks the domain as malicious.

Infrastructure
The domain resolved to IP 177.4.10.96, which was associated with Hong Kong Communications International Co., Limited in Hong Kong. TLS was issued by LiteSSL RSA CA 2025 to www.oru-okx.com.cn and oru-okx.com.cn, valid from 2026-10-20 to 2027-01-18. DNS records observed on 2026-10-23 showed a newly created domain with A, NS, and SOA records and no DNSSEC signatures. The certificate and TLS handshake were recorded as using TLS 1.3 with AES‑256‑GCM cipher.

What to do
Do not enter any credentials or download files from this site; if credentials were entered, change the associated passwords and enable two‑factor authentication on the real OKX account. Monitor the account for unauthorized activity. Defenders should block the exact domain in network filters, log any access attempts, and treat the recorded IP and TLS certificate as historical reference only.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a166cf-769e-740a-a93e-2e83aa8c6f49/
Cloudflare Radar report: https://radar.cloudflare.com/scan/aed6ebd6-1421-41e9-9fb0-74cc3d6f7e32
Stored capture screenshot: https://i.ibb.co/Z6bpNf55/d49fb423fb56.png
Cloudflare Radar screenshot (2026-10-23T03:34:01Z): https://screenshots.phishdestroy.io/cf/aed6ebd6-1421-41e9-9fb0-74cc3d6f7e32.png
URLScan screenshot (2026-10-23T02:25:08Z): https://screenshots.phishdestroy.io/us/01a16693-747d-727e-819e-7f8eb83953d0.png
URLScan capture report: https://urlscan.io/result/01a16693-747d-727e-819e-7f8eb83953d0/
URLScan screenshot (2026-10-23T02:47:22Z): https://screenshots.phishdestroy.io/us/01a166a7-d219-7059-b937-1e325289233a.png
URLScan capture report: https://urlscan.io/result/01a166a7-d219-7059-b937-1e325289233a/
VirusTotal report: https://www.virustotal.com/gui/domain/oru-okx.com.cn
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=oru-okx.com.cn
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 03:37:23 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/Z6bpNf55/d49fb423fb56.png
  Captured: 2026-10-23 03:32:07 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a166cf-769e-740a-a93e-2e83aa8c6f49.png
  Captured: 2026-10-23 03:32:07 UTC
  Source report: https://urlscan.io/result/01a166cf-769e-740a-a93e-2e83aa8c6f49/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/aed6ebd6-1421-41e9-9fb0-74cc3d6f7e32.png
  Captured: 2026-10-23 03:34:01 UTC
  Source report: https://radar.cloudflare.com/scan/aed6ebd6-1421-41e9-9fb0-74cc3d6f7e32
  SHA-256: 595de8a1c13997cc0fe05f55d28332ed68f3ed93ddcf9f5247142401dcf3c056
- URLQuery: https://screenshots.phishdestroy.io/uq/ecac4943-9606-4d2d-ab29-9aed4de4431f.png
  Source report: https://urlquery.net/report/ecac4943-9606-4d2d-ab29-9aed4de4431f
  SHA-256: 628dc87f14797dbfc7bfb44c89d0c44fb73a75ab161c157e84f8affcc3c23fc4
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16693-747d-727e-819e-7f8eb83953d0.png
  Captured: 2026-10-23 02:25:08 UTC
  Source report: https://urlscan.io/result/01a16693-747d-727e-819e-7f8eb83953d0/
  SHA-256: 30cfd6c9398f8fbed15961990467e2dc761eb71edc3dba52675ff4aa8e54f5b3
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a166a7-d219-7059-b937-1e325289233a.png
  Captured: 2026-10-23 02:47:22 UTC
  Source report: https://urlscan.io/result/01a166a7-d219-7059-b937-1e325289233a/
  SHA-256: b0edbc761b98a462b2f8ebe537895363e81aee01516202edce958a3326148c70

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T03:36:29Z",
        "uuid": "01a166cf-769e-740a-a93e-2e83aa8c6f49",
        "scanned_at": "2026-10-23T03:30:41Z",
        "final_url": "https://oru-okx.com.cn/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://oru-okx.com.cn/",
                "from": "http://oru-okx.com.cn/",
                "status": 307
            }
        ],
        "ip": "177.4.10.96",
        "ips": [
            "177.4.10.96"
        ],
        "asns": [
            "140227"
        ],
        "countries": [
            "HK"
        ],
        "link_domains": [
            "www.toprvkxwhpm.com",
            "www.mitnpkwxvfr.net"
        ],
        "doc_hash": "592c711a8c2408f78caad21b14b2b065c6400694f0e38f8fdf85d8ffa8c4fd54",
        "script_hashes": [
            "92206230941fb1cf561690227237f07c216cf5224a34ec7eb9180457d2739b81"
        ],
        "tls": {
            "san": [
                "www.oru-okx.com.cn",
                "oru-okx.com.cn"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "LiteSSL RSA CA 2025",
            "subject": "www.oru-okx.com.cn",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-18T03:59:59Z",
            "valid_from": "2026-10-20T04:00:00Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 2,
        "tls_valid_days": 89,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "okx"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "OKX"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T03:36:32Z",
        "uuid": "aed6ebd6-1421-41e9-9fb0-74cc3d6f7e32",
        "scanned_at": "2026-10-23T03:34:01Z",
        "final_url": "https://oru-okx.com.cn/",
        "status": 200,
        "history": [
            {
                "url": "https://oru-okx.com.cn/",
                "status": 200
            }
        ],
        "dom_hash": "cf901ef78302ed1cacd660be8a2341ad12705787e3cd87febc6073ab3104c8f2",
        "doc_hash": "592c711a8c2408f78caad21b14b2b065c6400694f0e38f8fdf85d8ffa8c4fd54",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "oru-okx.com.cn",
                "type": "A",
                "value": "177.4.10.96"
            }
        ],
        "dnssec_valid": false,
        "ip": "177.4.10.96",
        "whois": {
            "registrar": "Web Commerce Communications Limited",
            "created": "2026-10-20T12:34:05Z",
            "expires": "2027-10-20T12:34:05Z",
            "nameservers": [
                "a2.share-dns.com",
                "b2.share-dns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T03:33:06Z",
        "analysis_at": "2026-10-23T02:42:44Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 38
        },
        "reputation": 0,
        "first_seen": "2026-10-20T06:02:36Z",
        "dns": [
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "master.share-dns.com",
                "value": "a.share-dns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "a.share-dns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "b.share-dns.net"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "177.4.10.96"
            }
        ],
        "dns_at": "2026-10-23T02:48:15Z",
        "jarm": "3fd3fd0003fd3fd00042d42d0000002059a3b916699461c5923779b77cf06b",
        "cert": {
            "san": [
                "www.oru-okx.com.cn",
                "oru-okx.com.cn"
            ],
            "issuer": "TrustAsia Technologies, Inc. / LiteSSL RSA CA 2025",
            "serial": "30b6d331abe6a9763a54bca18be1d953b78e166a",
            "sha256": "f6f10bec98886194c29d7e20560aa2b559e913901ce1cf119b0b693b3765d233",
            "subject": "www.oru-okx.com.cn",
            "valid_to": "2027-01-18T03:59:59Z",
            "valid_from": "2026-10-20T04:00:00Z"
        },
        "whois": {
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "a2.share-dns.com",
                "b2.share-dns.net"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T03:36:45Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "oru-okx.com.cn"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-23T03:33:26Z",
            "first": "2026-10-23T03:33:26Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 7333
        },
        "social_tags": {
            "title": "欧易交易所 - 欧易 OKX 专题中心 | 交易安全解读",
            "author": "欧易 OKX",
            "ogType": "website",
            "robots": "index, follow",
            "ogImage": "assets/og-cover.svg",
            "ogTitle": "欧易交易所 - 欧易 OKX 专题中心 | 交易安全解读",
            "keywords": "欧易交易所,欧易,欧易 OKX,交易安全,行情解读,新手专题,专题策划",
            "ogSiteName": "欧易 OKX",
            "themeColor": "#1b1611",
            "description": "欧易交易所专题中心围绕交易安全、新手入门与行情变化做系统策划：每期把一个问题拆成多篇文章，欧易用户可从头读到尾，也可按需查阅。",
            "ogDescription": "欧易交易所专题中心：每期一个主题，拆成多篇文章，一次讲透。"
        },
        "trackers": {
            "requests": 3
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 294,
                "tls": 230,
                "wait": 403,
                "connect": 201,
                "download": 7
            },
            "response_ms": 1135
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 27878,
            "co2_grams": 0.001,
            "cleaner_than": 50
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.53.25",
                    "host": "a.share-dns.com"
                },
                {
                    "ip": "162.159.27.88",
                    "host": "b.share-dns.net"
                }
            ],
            "zone": "oru-okx.com.cn"
        },
        "location": {
            "ip": "177.4.10.96",
            "asn": "140227",
            "org": "Hong Kong Communications International Co., Limited",
            "city": "Hong Kong",
            "country": "HK"
        },
        "ssl": {
            "issuer": "TrustAsia Technologies, Inc. / LiteSSL RSA CA 2025",
            "subject": "www.oru-okx.com.cn"
        },
        "dns": {
            "A": [
                "177.4.10.96"
            ],
            "NS": [
                "b.share-dns.net",
                "a.share-dns.com"
            ],
            "SOA": "{\"nsname\": \"a.share-dns.com\", \"hostmaster\": \"master.share-dns.com\", \"serial\": 1792474301, \"refresh\": 3600, \"retry\": 1200, \"expire\": 86400, \"minttl\": 600}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "177.4.10.96",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://oru-okx.com.cn"
            ]
        },
        "subdomains": {
            "count": 2,
            "subdomains": [
                "cn.oru-okx.com.cn",
                "www.oru-okx.com.cn"
            ]
        },
        "linked_pages": {
            "external": [
                "https://www.toprvkxwhpm.com/upgradeapp/android_ACE532512.apk",
                "https://www.mitnpkwxvfr.net/zh-hans/join"
            ],
            "external_count": 2,
            "internal_count": 6
        },
        "whois": {
            "registrar": "Web Commerce Communications Limited",
            "created": "2026-10-20T10:34:05Z",
            "expires": "2027-10-20T10:34:05Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "a2.share-dns.com",
                "b2.share-dns.net"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```