# PhishDestroy domain threat record: ufo-okx.com.cn

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/ufo-okx.com.cn/
Machine-readable companion: https://phishdestroy.io/domain/ufo-okx.com.cn/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-21 15:25:31 UTC
- Last availability or vendor check: 2026-10-22 10:49:30 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: OKX

## Stored infrastructure

- Observed IP address: 219.234.2.102
- Registrar in stored WHOIS data: Web Commerce Communications Limited
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-19 15:03:47 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a15f21-8660-712d-8552-763a7d85b3f6/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/ufo-okx.com.cn
- Certificate Transparency search: https://crt.sh/?q=%25.ufo-okx.com.cn
- Web Archive lookup: https://web.archive.org/web/*/https://ufo-okx.com.cn/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake analysis classified the site as malicious because it impersonates the OKX cryptocurrency exchange, using the recorded page title “注册欧易 | 欧易官网提供快捷便利的线上交易服务” to promote app downloads. The domain was first observed by PhishDestroy on 2026-10-21, when an HTTP 200 response was recorded.

How the scam works
Fake‑exchange pages copy the branding of legitimate services and present download links for Android or iOS applications. When a victim installs the counterfeit app, it can capture login credentials, private keys or request wallet approvals, enabling credential theft or unauthorized transfers. The scheme relies on the victim’s trust in the familiar brand name and the promise of a convenient trading app.

Evidence
VirusTotal scanned the domain on 2026-10-21 with 92 engines and reported zero malicious or suspicious detections. Google Safe Browsing checked the same day and did not flag the URL. urlscan.io captured a screenshot on 2026-10-21 and returned a clean verdict. External blocklists MetaMask and SEAL listed the domain, and PhishDestroy’s internal blocklist also contains it. OTX showed no pulses for the domain on the same date.

Infrastructure
The recorded IP address was 219.234.2.102, which appeared in the network record as West263 International Limited in Hong Kong. DNS records observed on 2026-10-21 listed ns1.julydns.com and ns2.julydns.com as authoritative name servers. The certificate check on 2026-10-21 found a Let’s Encrypt certificate for www.ufo-okx.com.cn and the server header indicated Nginx with HSTS enabled. Open ports observed were 21, 80 and 443.

What to do
Do not download or install any application offered from this site and avoid entering OKX credentials there. If credentials were entered, change the associated passwords and review the OKX account for unauthorized activity. Defenders should block the domain at the network perimeter and monitor logs for connections to the recorded IP address.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a15f21-8660-712d-8552-763a7d85b3f6/
Cloudflare Radar report: https://radar.cloudflare.com/scan/cfcb4149-7992-4032-a2fb-0d3ae675f777
Stored capture screenshot: https://urlscan.io/screenshots/01a15f21-8660-712d-8552-763a7d85b3f6.png
VirusTotal report: https://www.virustotal.com/gui/domain/ufo-okx.com.cn
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ufo-okx.com.cn
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-21 15:48:41 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a15f21-8660-712d-8552-763a7d85b3f6.png
  Captured: 2026-10-21 15:45:16 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a15f21-8660-712d-8552-763a7d85b3f6.png
  Captured: 2026-10-21 15:45:16 UTC
  Source report: https://urlscan.io/result/01a15f21-8660-712d-8552-763a7d85b3f6/
- URLScan capture 2: https://urlscan.io/screenshots/01a15d08-5baa-77f1-a9a8-b5da5d3f58f6.png
  Captured: 2026-10-21 15:25:31 UTC
  Source report: https://urlscan.io/result/01a15f21-8660-712d-8552-763a7d85b3f6/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/cfcb4149-7992-4032-a2fb-0d3ae675f777.png
  Captured: 2026-10-21 15:40:58 UTC
  Source report: https://radar.cloudflare.com/scan/cfcb4149-7992-4032-a2fb-0d3ae675f777
  SHA-256: 13e63049581580cd27a64d2a21273c0c2a51ad8317e0d60f704cc63a6a43d556
- URLQuery: https://screenshots.phishdestroy.io/uq/10ba6319-7c93-4e65-8144-790444266f97.png
  Source report: https://urlquery.net/report/10ba6319-7c93-4e65-8144-790444266f97
  SHA-256: faf3122f7165a275a3da1dedda22b08867b00630291943f1e2aadc12330ab10c
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15d08-5baa-77f1-a9a8-b5da5d3f58f6.png
  Captured: 2026-10-21 05:56:42 UTC
  Source report: https://urlscan.io/result/01a15d08-5baa-77f1-a9a8-b5da5d3f58f6/
  SHA-256: a14962102d872a88dae6e378020a14e8672c4646de89f86c14fd89c9b6263473
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15f13-a9f4-74fd-8ac7-0b203b65fcdd.png
  Captured: 2026-10-21 15:28:18 UTC
  Source report: https://urlscan.io/result/01a15f13-a9f4-74fd-8ac7-0b203b65fcdd/
  SHA-256: a14962102d872a88dae6e378020a14e8672c4646de89f86c14fd89c9b6263473
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15f15-a9ec-704e-89da-b36e0509b482.png
  Captured: 2026-10-21 15:30:51 UTC
  Source report: https://urlscan.io/result/01a15f15-a9ec-704e-89da-b36e0509b482/
  SHA-256: 3d7ae32a573dea76ba281cbbf68251f7e537a946f3218b84804eb3760301e26a
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15f1c-ab75-7625-b5f6-f9a340c403a5.png
  Captured: 2026-10-21 15:38:35 UTC
  Source report: https://urlscan.io/result/01a15f1c-ab75-7625-b5f6-f9a340c403a5/
  SHA-256: 3d7ae32a573dea76ba281cbbf68251f7e537a946f3218b84804eb3760301e26a

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T16:22:50Z",
        "uuid": "01a15f21-8660-712d-8552-763a7d85b3f6",
        "scanned_at": "2026-10-21T15:43:24Z",
        "final_url": "https://ufo-okx.com.cn/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://ufo-okx.com.cn/",
                "from": "http://ufo-okx.com.cn/",
                "status": 307
            }
        ],
        "ip": "219.234.2.102",
        "domains": [
            "aj.nly5.cn"
        ],
        "ips": [
            "108.187.227.148",
            "219.234.2.102"
        ],
        "asns": [
            "132839",
            "139021"
        ],
        "countries": [
            "US",
            "CN"
        ],
        "link_domains": [
            "www.dkgwpqxvfnr.com",
            "www.btmzhjpdgxc.org"
        ],
        "doc_hash": "ed93a1bdeb7dbe3721731c0a296c535608c9f558789b0d6d25388bd69c207b02",
        "tls": {
            "san": [
                "ufo-okx.com.cn",
                "www.ufo-okx.com.cn",
                "zh.ufo-okx.com.cn"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR2",
            "subject": "www.ufo-okx.com.cn",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-18T01:09:34Z",
            "valid_from": "2026-10-20T01:09:35Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 12,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "okx"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "OKX"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T15:44:21Z",
        "uuid": "cfcb4149-7992-4032-a2fb-0d3ae675f777",
        "scanned_at": "2026-10-21T15:40:58Z",
        "final_url": "https://ufo-okx.com.cn/",
        "status": 200,
        "history": [
            {
                "url": "https://ufo-okx.com.cn/",
                "status": 200
            }
        ],
        "dom_hash": "4fe3c2474d26ab7549e6623bcc3e889d4f8c68af9517f0e43bf8654ecde22f91",
        "doc_hash": "ed93a1bdeb7dbe3721731c0a296c535608c9f558789b0d6d25388bd69c207b02",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "ufo-okx.com.cn",
                "type": "A",
                "value": "219.234.2.102"
            }
        ],
        "dnssec_valid": false,
        "ip": "219.234.2.102",
        "whois": {
            "registrar": "Web Commerce Communications Limited",
            "created": "2026-10-19T17:03:47Z",
            "expires": "2027-10-19T17:03:47Z",
            "nameservers": [
                "ns1.julydns.com",
                "ns2.julydns.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T15:40:25Z",
        "analysis_at": "2026-10-21T15:37:54Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "first_seen": "2026-10-20T02:41:49Z",
        "dns": [
            {
                "ttl": 1,
                "type": "A",
                "value": "219.234.2.102"
            },
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "master.jmdns.com",
                "value": "ns1.julydns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.julydns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.julydns.com"
            }
        ],
        "dns_at": "2026-10-21T15:38:55Z",
        "whois": {
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.julydns.com",
                "ns2.julydns.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-21T15:44:43Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "ufo-okx.com.cn"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-21T15:28:11Z",
            "first": "2026-10-21T15:28:11Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 9639
        },
        "social_tags": {
            "title": "注册欧易 | 欧易官网提供快捷便利的线上交易服务",
            "keywords": "欧易,欧易官网,欧易交易,欧易app,欧易下载",
            "description": "欢迎来到欧易官网平台 官方首页，提供安卓与苹果双端下载入口，支持快速安装与账户访问。本页汇集下载说明、功能介绍、使用流程与安全提醒，帮助新用户快速找到正确入口并顺利完成安装，访问流畅稳定。"
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 974,
                "tls": 255,
                "wait": 488,
                "connect": 245,
                "download": 1
            },
            "response_ms": 1963
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                21,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 30836,
            "co2_grams": 0.0011,
            "cleaner_than": 47
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.27.251",
                    "host": "ns2.julydns.com"
                },
                {
                    "ip": "101.37.78.254",
                    "host": "ns1.julydns.com"
                }
            ],
            "zone": "ufo-okx.com.cn"
        },
        "location": {
            "ip": "219.234.2.102",
            "asn": "139021",
            "org": "West263 International Limited",
            "city": "Hong Kong",
            "country": "HK"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR2",
            "subject": "www.ufo-okx.com.cn"
        },
        "dns": {
            "A": [
                "219.234.2.102"
            ],
            "NS": [
                "ns2.julydns.com",
                "ns1.julydns.com"
            ],
            "SOA": "{\"nsname\": \"ns1.julydns.com\", \"hostmaster\": \"master.jmdns.com\", \"serial\": 1792461123, \"refresh\": 3600, \"retry\": 1200, \"expire\": 86400, \"minttl\": 600}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "219.234.2.102",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://ufo-okx.com.cn"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Nginx",
                "HSTS"
            ]
        },
        "linked_pages": {
            "external": [
                "https://www.dkgwpqxvfnr.com/upgradeapp/android_ACE863952.apk",
                "https://www.btmzhjpdgxc.org/join/ACE863952"
            ],
            "external_count": 2,
            "internal_count": 7
        },
        "whois": {
            "registrar": "Web Commerce Communications Limited",
            "created": "2026-10-19T15:03:47Z",
            "expires": "2027-10-19T15:03:47Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.julydns.com",
                "ns2.julydns.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```