apeswap[.]in[.]net

On July 24, 2026, the domain apeswap.in.net was observed as offline. The site previously served a page with title "OK9 ✔️ Trang Chủ OK9 COM | Link Đăng Nhập OK9 Chuẩn 2025", indicating a possible credential‑harvesting front‑end that references the OK9 brand. The domain is registered through Cloudflare, Inc., and resolves to the IP address 172.67.153.76, which belongs to AS13335 Cloudflare, Inc. in the United States. No TLS certificate was presented; the HTTPS endpoint terminated without a valid certificate, which is atypical for legitimate services and may facilitate man‑in‑the‑middle attacks. The domain appears on a single security blocklist and was specifically blocked by the PhishDestroy service, reinforcing the suspicion of malicious use.

Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating, indicating a high confidence of abuse. VirusTotal scanned the site with 95 engines and reported no detections, but the report explicitly notes that the lack of detections does not constitute evidence of safety. The nameservers alaric.ns.cloudflare.com and hope.ns.cloudflare.com are standard Cloudflare infrastructure and do not provide additional attribution. No evidence of safe‑browsing or OTX entries was found.

Because the site is currently offline, direct verification of the content is impossible, and the exact phishing or crypto‑drain mechanism remains unconfirmed. Defenders should continue to block the domain at perimeter defenses, monitor for resurgence or re‑registration, and correlate any outbound connections to 172.67.153.76 with internal logs. Threat intel feeds should be updated to reflect the observed indicators, and any user reports of login prompts referencing OK9 should be treated as compromised. Continuous surveillance is advised until the domain is either confirmed clean or permanently retired.