ooo[.]ouyi[.]one

The domain ooo.ouyi.one is currently active and was registered on May 21, 2026 through GoDaddy.com, LLC. It uses the authoritative name servers pdns04.domaincontrol.com and pdns03.domaincontrol.com and resolves to the IP address 156.255.3.241, which is geolocated to Hong Kong and hosted by the UFO Network. The site presents an HTTPS certificate issued by Let's Encrypt (R13) and returns an HTTP 200 response. The page title "欧易OKX | 官方APP下载中心 | 安卓 | iOS | 电脑版客户端" explicitly references the OKX brand, indicating a brand‑impersonation campaign aimed at crypto users. The threat is classified as a crypto scam, with a high risk rating. Independent analysis shows a Gridinsoft trust score of 0/100, and the domain appears on one security blocklist, having been blocked by PhishDestroy. VirusTotal reported ten detections out of ninety‑one scanners. At present, no additional content analysis is available beyond the title, so the exact malicious behaviour (e.g., credential harvesting or malware delivery) cannot be confirmed. Defenders should consider immediate blocking of the domain and its resolving IP, enforce URL filtering for traffic to the host, and monitor for any related indicator of compromise. Continuous observation of the UFO Network hosting environment is advised, as the infrastructure may be reused for further impersonation attempts targeting OKX or other cryptocurrency services.