votingokx[.]com

The domain votingokx.com was registered on April 22, 2026 via PublicDomainRegistry.com (operated by PDR Ltd.). It currently resolves to 172.67.215.222, a Cloudflare‑hosted address located in Canada. The site returns an HTTP 301 redirect and presents a generic directory listing with the title “Index of /”. Automated analysis classifies the site as a high‑risk brand‑impersonation campaign targeting the cryptocurrency exchange OKX.

Infrastructure assessment shows the domain uses Cloudflare nameservers jerome.ns.cloudflare.com and reza.ns.cloudflare.com, and presents a valid Let’s Encrypt certificate (issuer E7). The SSL certificate is correctly chained, which helps the site appear legitimate to end users. The presence of a Cloudflare edge mitigates direct IP probing but does not conceal the underlying hosting location, which is identified as Canada.

Threat intelligence feeds have flagged votingokx.com on three independent blocklists, including PhishDestroy, MetaMask, and SEAL. The domain also appears in a single AlienVault OTX pulse, and one of ninety‑five VirusTotal scanners raised a detection. These corroborating signals indicate active abuse, although the precise phishing payload or credential‑harvesting page has not been captured in public samples.

Defenders should add votingokx.com to network and email filtering rules, enforce DNS sink‑hole redirects, and monitor for any traffic to the 172.67.215.222 address. Because the domain leverages a trusted TLS certificate, additional heuristics such as brand‑specific URL patterns and anomalous redirect behavior are recommended to reduce false negatives. Continuous observation of the domain’s DNS records and blocklist status is advised, as the operator may employ fast‑flux techniques or generate new look‑alike domains.