# PhishDestroy domain threat record: rots-okx.com.cn

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/rots-okx.com.cn/
Machine-readable companion: https://phishdestroy.io/domain/rots-okx.com.cn/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 13:07:35 UTC
- Last availability or vendor check: 2026-10-23 13:07:35 UTC
- Stored record updated: 2026-10-23 18:22:30 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: OKX

## Stored infrastructure

- Observed IP address: 23.231.153.33
- Registrar in stored WHOIS data: Web Commerce Communications Limited
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-15 12:20:41 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a168de-2cfa-74f9-af64-b17af3f05fb3/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/rots-okx.com.cn
- Certificate Transparency search: https://crt.sh/?q=%25.rots-okx.com.cn
- Web Archive lookup: https://web.archive.org/web/*/https://rots-okx.com.cn/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI classified the page as malicious because it pretended to be the OKX exchange and advertised an Android app download. The recorded page title read "欧易官网下载 - okx安卓版 - 欧易交易所", matching the impersonation claim. The domain was first observed by PhishDestroy on 2026-10-23 and returned an HTTP 200 response at that time.

How the scam works
In brand‑impersonation scams, attackers host a look‑alike site that offers a downloadable application claiming to be the official client. The supplied APK often contains malware that can harvest credentials, inject transactions, or compromise the device once installed.

Evidence
VirusTotal scanned the domain on 2026-10-21 and reported zero detections from 92 engines. Google Safe Browsing checked on 2026-10-23 and did not flag the site. OTX recorded no pulses for the domain as of 2026-10-23. URLScan’s machine‑learning engine marked the page malicious with a score of 100 and tags indicating high confidence, and PhishDestroy’s internal blocklist contained the domain with a noted brand‑impersonation and malicious‑download risk.

Infrastructure
The recorded IP was 23.231.153.33, and the network record listed POWER LINE (HK) CO., LIMITED in Hong Kong (ASN 132839). TLS was issued on 2026-10-21 by LiteSSL RSA CA 2025 and was valid until 2027-01-19. The recorded domain age was 0 days at capture, indicating it was newly seen, and the domain used ns1.julydns.com and ns2.julydns.com as nameservers. DNSSEC signatures were not observed in the recorded DNS data.

What to do
Do not download or install any application from this site and remove any APK already installed, replacing it with the official version from the legitimate app store. Users who may have entered credentials should change them on the real OKX platform and review account activity. Organizations should block rots-okx.com.cn in web filters and monitor outbound traffic for connections to the recorded host.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a168de-2cfa-74f9-af64-b17af3f05fb3/
Cloudflare Radar report: https://radar.cloudflare.com/scan/cd598eda-771e-4e06-a498-bb23d1e870fb
Stored capture screenshot: https://i.ibb.co/CsQg3y9W/7c62f55e4dd7.png
Cloudflare Radar screenshot (2026-10-23T13:08:05Z): https://screenshots.phishdestroy.io/cf/cd598eda-771e-4e06-a498-bb23d1e870fb.png
URLScan screenshot (2026-10-23T13:00:15Z): https://screenshots.phishdestroy.io/us/01a168d8-e77f-772c-babf-2d88a4d8d208.png
URLScan capture report: https://urlscan.io/result/01a168d8-e77f-772c-babf-2d88a4d8d208/
URLScan screenshot (2026-10-23T13:06:32Z): https://screenshots.phishdestroy.io/us/01a168de-0d2b-7421-b3b2-85e800df2f9d.png
URLScan capture report: https://urlscan.io/result/01a168de-0d2b-7421-b3b2-85e800df2f9d/
VirusTotal report: https://www.virustotal.com/gui/domain/rots-okx.com.cn
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=rots-okx.com.cn
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 13:09:14 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/CsQg3y9W/7c62f55e4dd7.png
  Captured: 2026-10-23 13:07:35 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a168de-2cfa-74f9-af64-b17af3f05fb3.png
  Captured: 2026-10-23 13:07:35 UTC
  Source report: https://urlscan.io/result/01a168de-2cfa-74f9-af64-b17af3f05fb3/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/cd598eda-771e-4e06-a498-bb23d1e870fb.png
  Captured: 2026-10-23 13:08:05 UTC
  Source report: https://radar.cloudflare.com/scan/cd598eda-771e-4e06-a498-bb23d1e870fb
  SHA-256: fd204b07f3e0915c7387f9e28bd5343a10cf7fe571b7286dffc7db13193631a5
- URLQuery: https://screenshots.phishdestroy.io/uq/3fa50a1f-f688-4877-ad5d-c9bffbe8b87b.png
  Source report: https://urlquery.net/report/3fa50a1f-f688-4877-ad5d-c9bffbe8b87b
  SHA-256: 751351df94ee04ac72a3bbe96e94588ebcb059d69afd79382148cad4605d25b1
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a168d8-e77f-772c-babf-2d88a4d8d208.png
  Captured: 2026-10-23 13:00:15 UTC
  Source report: https://urlscan.io/result/01a168d8-e77f-772c-babf-2d88a4d8d208/
  SHA-256: f302ee604c4f69b1e680af12f4e246483f6a47a216ede50f69880ec5955d956b
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a168de-0d2b-7421-b3b2-85e800df2f9d.png
  Captured: 2026-10-23 13:06:32 UTC
  Source report: https://urlscan.io/result/01a168de-0d2b-7421-b3b2-85e800df2f9d/
  SHA-256: f302ee604c4f69b1e680af12f4e246483f6a47a216ede50f69880ec5955d956b

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T13:08:21Z",
        "uuid": "01a168de-2cfa-74f9-af64-b17af3f05fb3",
        "scanned_at": "2026-10-23T13:07:26Z",
        "final_url": "https://rots-okx.com.cn/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://rots-okx.com.cn/",
                "from": "http://rots-okx.com.cn/",
                "status": 307
            }
        ],
        "ip": "23.231.153.33",
        "ips": [
            "23.231.153.33"
        ],
        "asns": [
            "132839"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "b9d58df76768efaca368a219e35b3be9df96c62e038f5b34f626fcf838f87d8d",
        "tls": {
            "san": [
                "rots-okx.com.cn"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "LiteSSL RSA CA 2025",
            "subject": "rots-okx.com.cn",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-19T04:59:59Z",
            "valid_from": "2026-10-21T05:00:00Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 2,
        "tls_valid_days": 89,
        "requests": 3,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T13:08:23Z",
        "uuid": "cd598eda-771e-4e06-a498-bb23d1e870fb",
        "scanned_at": "2026-10-23T13:08:05Z",
        "final_url": "https://rots-okx.com.cn/",
        "status": 200,
        "history": [
            {
                "url": "https://rots-okx.com.cn/",
                "status": 200
            }
        ],
        "dom_hash": "815b2affd06f2c2d023609dfc899231ef9d6ebaec65dc4758324793546d564e7",
        "doc_hash": "b9d58df76768efaca368a219e35b3be9df96c62e038f5b34f626fcf838f87d8d",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "rots-okx.com.cn",
                "type": "A",
                "value": "23.231.153.33"
            }
        ],
        "dnssec_valid": false,
        "ip": "23.231.153.33",
        "whois": {
            "registrar": "Web Commerce Communications Limited",
            "created": "2026-10-15T14:20:41Z",
            "expires": "2027-10-15T14:20:41Z",
            "nameservers": [
                "ns1.julydns.com",
                "ns2.julydns.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T13:07:58Z",
        "analysis_at": "2026-10-21T08:44:45Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "first_seen": "2026-10-21T08:44:45Z",
        "dns": [
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "master.jmdns.com",
                "value": "ns1.julydns.com"
            },
            {
                "ttl": 100,
                "type": "A",
                "value": "23.231.153.33"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.julydns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.julydns.com"
            }
        ],
        "dns_at": "2026-10-21T08:51:00Z",
        "jarm": "3fd3fd0003fd3fd00042d42d0000002059a3b916699461c5923779b77cf06b",
        "cert": {
            "san": [
                "rots-okx.com.cn"
            ],
            "issuer": "TrustAsia Technologies, Inc. / LiteSSL RSA CA 2025",
            "serial": "7aaee6424fe83bdb1292b83e41f7c34f3f91678e",
            "sha256": "2b71c6252973c438f8f73666ef6ec025076b7419fefbaea008bf002f97f289e4",
            "subject": "rots-okx.com.cn",
            "valid_to": "2027-01-19T04:59:59Z",
            "valid_from": "2026-10-21T05:00:00Z"
        },
        "whois": {
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.julydns.com",
                "ns2.julydns.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T13:08:46Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "rots-okx.com.cn"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://rots-okx.com.cn/sitemap-index.xml",
                "https://rots-okx.com.cn/sitemap-download.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 1
        },
        "social_tags": {
            "ogUrl": "https://rots-okx.com.cn/",
            "title": "欧易官网下载 - okx安卓版 - 欧易交易所",
            "author": "欧易 OKX 官网",
            "ogType": "website",
            "robots": "index,follow,max-image-preview:large,max-snippet:-1",
            "ogImage": "https://rots-okx.com.cn/og-black.svg",
            "ogTitle": "欧易官网下载 - okx安卓版 - 欧易交易所",
            "keywords": "欧易官网下载,okx安卓版,欧易交易所,欧易安卓版,注册开户",
            "ogSiteName": "欧易 OKX 官网",
            "themeColor": "#07080B",
            "description": "欧易官网下载页把 okx 安卓版的取包入口与品牌底细放在一处，安装包现为 v6.92.0，大小 168MB，系统需 Android 6.0 或更高，2026 年 9 月 18 日发布，开户用手机号或邮箱即可。",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://rots-okx.com.cn/",
            "ogDescription": "okx 安卓版的取包入口与品牌底细放在一处，v6.92.0，168MB。"
        },
        "trackers": {
            "requests": 2
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 265,
                "wait": 523,
                "connect": 261,
                "download": 1
            },
            "response_ms": 1052
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 32078,
            "co2_grams": 0.0012,
            "cleaner_than": 47
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.48.223",
                    "host": "ns1.julydns.com"
                },
                {
                    "ip": "162.159.27.251",
                    "host": "ns2.julydns.com"
                }
            ],
            "zone": "rots-okx.com.cn"
        },
        "location": {
            "ip": "23.231.153.33",
            "asn": "132839",
            "org": "POWER LINE (HK) CO., LIMITED",
            "city": "Tin Shui Wai",
            "country": "HK"
        },
        "ssl": {
            "issuer": "TrustAsia Technologies, Inc. / LiteSSL RSA CA 2025",
            "subject": "rots-okx.com.cn"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "23.231.153.33",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://rots-okx.com.cn"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Nginx",
                "HSTS",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "internal_count": 9
        },
        "whois": {
            "registrar": "Web Commerce Communications Limited",
            "created": "2026-10-15T12:20:41Z",
            "expires": "2027-10-15T12:20:41Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.julydns.com",
                "ns2.julydns.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```