get-okx[.]com[.]cn

This domain, get-okx.com.cn, is flagged as a high-risk brand impersonation threat designed to deceive users of the OKX digital asset exchange platform. Analysis indicates the site employs social engineering tactics to mimic legitimate OKX branding, including the use of trademarks, page titles, and claims of security and efficiency. The threat type is classified as brand impersonation with a focus on credential harvesting or fraudulent transaction facilitation, a common vector for financial theft in the cryptocurrency sector.

Infrastructure analysis reveals multiple concrete indicators of malicious activity. The domain was registered on April 21, 2026, through 杭州云集通信科技有限公司, a registrar frequently associated with high-risk domains. It resolves to the IP address 154.94.239.120, which has been linked to prior phishing campaigns. Security vendor detections include 14 out of 95 flags on VirusTotal, while Google Safe Browsing categorizes the domain under SOCIAL_ENGINEERING. The domain appears on three security blocklists and holds a Gridinsoft trust score of 0/100, further corroborating its malicious nature. Detected technologies include Nginx as the web server and HTTP Strict Transport Security (HSTS), which may be leveraged to lend an air of legitimacy to the fraudulent site.

Mitigation steps for this threat type include immediate domain takedown requests to hosting providers and registrars, leveraging the documented evidence of malicious activity. Organizations should update security blocklists to include the domain and its associated IP address, 154.94.239.120, to prevent user access. End users should be educated on identifying brand impersonation tactics, such as verifying domain authenticity through official channels and scrutinizing page titles or URLs for inconsistencies. Monitoring for similar domains registered through the same registrar or resolving to the same IP range is recommended to preemptively identify related threats.