# PhishDestroy domain threat record: poll-okxvote-439.pages.dev Content language: English Canonical HTML report: https://phishdestroy.io/domain/poll-okxvote-439.pages.dev/ Machine-readable companion: https://phishdestroy.io/domain/poll-okxvote-439.pages.dev/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-10-22 21:30:31 UTC - Last availability or vendor check: 2026-10-22 23:07:02 UTC - Stored record updated: 2026-10-22 23:07:02 UTC - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: ScamSniffer - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: OKX ## Stored infrastructure - Observed IP address: 172.66.44.150 - Registrar in stored WHOIS data: Cloudflare, Inc. - Last stored HTTP status: 403 - Registration date (registry RDAP, pages.dev): 2020-09-02 02:33:29 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16584-2326-7400-a35a-75c830daeb17/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/poll-okxvote-439.pages.dev - Certificate Transparency search: https://crt.sh/?q=%25.poll-okxvote-439.pages.dev - Web Archive lookup: https://web.archive.org/web/*/https://poll-okxvote-439.pages.dev/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored page captures - Primary capture: https://i.ibb.co/Sw3PmdrP/151f3b545b77.png Captured: 2026-10-22 21:30:31 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a16584-2326-7400-a35a-75c830daeb17.png Captured: 2026-10-22 21:30:31 UTC Source report: https://urlscan.io/result/01a16584-2326-7400-a35a-75c830daeb17/ - URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14923-b28f-7195-808c-17557eda4d9c.png Captured: 2026-10-17 09:14:04 UTC Source report: https://urlscan.io/result/01a14923-b28f-7195-808c-17557eda4d9c/ SHA-256: de4e568ed35f89614844e7fba4e7b5b041b173ade9ed23fa7d813ff622ab77d4 - URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a11ef8-9fa1-742a-a35b-4fcf23aa9f23.png Captured: 2026-10-09 04:43:07 UTC Source report: https://urlscan.io/result/01a11ef8-9fa1-742a-a35b-4fcf23aa9f23/ SHA-256: de4e568ed35f89614844e7fba4e7b5b041b173ade9ed23fa7d813ff622ab77d4 - URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a149a4-dcc4-7597-88d9-36a62b62e88d.png Captured: 2026-10-17 11:35:10 UTC Source report: https://urlscan.io/result/01a149a4-dcc4-7597-88d9-36a62b62e88d/ SHA-256: cae20fb260186eed8022f794db148186a63637c139aa8bb5953be634bc140b12 - URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14bf0-9b72-7121-ab02-34f7d38bf085.png Captured: 2026-10-17 22:17:07 UTC Source report: https://urlscan.io/result/01a14bf0-9b72-7121-ab02-34f7d38bf085/ SHA-256: de4e568ed35f89614844e7fba4e7b5b041b173ade9ed23fa7d813ff622ab77d4 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-22T21:42:51Z", "uuid": "01a16584-2326-7400-a35a-75c830daeb17", "scanned_at": "2026-10-22T21:28:46Z", "final_url": "https://poll-okxvote-439.pages.dev/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://poll-okxvote-439.pages.dev/", "from": "http://poll-okxvote-439.pages.dev/", "status": 307 } ], "ip": "172.66.44.150", "domains": [ "ipwho.is", "jup.ag", "images.ctfassets.net", "play-lh.googleusercontent.com", "walletadapter-cdn-cloud.com", "ipapi.co", "iconic.dynamic-static-assets.com" ], "ips": [ "172.66.175.107", "172.64.144.197", "143.204.181.76", "142.251.13.119", "172.66.44.150" ], "asns": [ "13335", "16509", "15169" ], "countries": [ "US" ], "doc_hash": "5c0f5e2045c002a21115614c896632a2823906a64c12d4f68d4f80d1bb3ad0e5", "script_hashes": [ "100b166c11248cd2223b9648dd299d9134d41bc98e065e0511179b32327c6d4a", "6d389ca9451f9b32e2c6d023bf268955feb46b432c17d24b1a17d3fbd5af6066" ], "globals": [ "_4nk8201", "_0x10be", "_0x227e", "_0x9vc6571", "injectScript", "__reactRouterVersion", "__preloadIframeInitialized", "__globalPreloadFrame", "pth" ], "storage_keys": [ "__kiwiVisitSent", "kiwi_user_ip", "kiwi_user_country", "kiwi_user_countryCode", "kiwi_user_flag" ], "tls": { "san": [ "poll-okxvote-439.pages.dev", "*.poll-okxvote-439.pages.dev" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "poll-okxvote-439.pages.dev", "protocol": "QUIC", "valid_to": "2026-12-04T00:56:49Z", "valid_from": "2026-09-04T23:58:10Z" }, "domain_age_days": 45, "apex_age_days": 45, "tls_age_days": 47, "tls_valid_days": 90, "requests": 16, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "okx" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "OKX" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } }, "vt": { "v": 1, "fetched_at": "2026-10-22T22:03:40Z", "analysis_at": "2026-10-17T15:38:30Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 1, "undetected": 36 }, "detections": { "Gridinsoft": "suspicious" }, "reputation": 0, "tags": [ "dga" ], "registrar": "CloudFlare, Inc.", "created": "2020-09-02T02:33:29Z", "expires": "2026-09-02T02:33:29Z", "updated": "2025-03-17T14:56:22Z", "first_seen": "2026-09-07T01:54:18Z", "dns": [ { "ttl": 300, "type": "A", "value": "172.66.47.106" }, { "ttl": 300, "type": "A", "value": "172.66.44.150" }, { "ttl": 21600, "type": "NS", "value": "rosalie.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "rosalie.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:310c::ac42:2f6a" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:310c::ac42:2c96" }, { "ttl": 21600, "type": "NS", "value": "trevor.ns.cloudflare.com" } ], "dns_at": "2026-10-17T15:59:21Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "poll-okxvote-439.pages.dev", "*.poll-okxvote-439.pages.dev" ], "issuer": "Google Trust Services / WE1", "serial": "eb5353585fc3b6313d48ab972d7923a", "sha256": "ebac098c1df9cc8eb9ca95b6f35cac125559eb374cbc9b22c83ecff894ce30c1", "subject": "poll-okxvote-439.pages.dev", "valid_to": "2026-12-04T00:56:49Z", "valid_from": "2026-09-04T23:58:10Z" }, "whois": { "registrar": "CloudFlare, Inc.", "registrar_iana_id": "1910", "registrar_url": "None", "created": "2020-09-02T02:33:29Z", "updated": "2023-09-04T18:15:07Z", "expires": "2026-09-02T02:33:29Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited", "clientdeleteprohibited", "clienttransferprohibited", "clientupdateprohibited" ], "nameservers": [ "adi.ns.cloudflare.com", "karl.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```