okx[.]com[.]gy

The domain okx.com.gy has been observed in a recent phishing investigation. Automated analysis indicates that the domain is currently listed on a single security blocklist and has been actively blocked by the PhishDestroy feed. VirusTotal records show that the site was scanned by 91 independent AV engines, none of which reported a detection at the time of the scan.

The absence of detections does not constitute an assurance of legitimacy; the domain remains classified as a generic phishing vector pending further evidence. The risk level is marked as “under investigation” and the operational status is reported as active, meaning the infrastructure is presently reachable and may be used to host malicious content. No additional intelligence such as registrar details, hosting IP, ASN, SSL certificate attributes, or page title has been released, so the full attack surface cannot be fully mapped.

Defenders should add okx.com.gy to outbound URL filtering rules, enforce DNS sink‑hole or blocklist policies, and monitor network traffic for any connections to the domain. Continuous re‑scanning with multi‑engine services is recommended to detect any future changes in the payload or detection status. Incident response teams should treat any credential submissions to the domain as compromised and initiate credential reset procedures for affected accounts.