ouyi[.]clinic

Analysis of the domain ouyi.clinic indicates active impersonation of the cryptocurrency exchange OKX, targeting users with a fraudulent referral scheme. The domain was registered on November 28, 2023, through Dynadot Inc, and currently resolves to the IP address 54.215.31.113, hosted on AWS EC2 infrastructure in the US-West-1 region. Infrastructure review reveals the use of nameservers ns1.dyna-ns.net and ns2.dyna-ns.net, alongside a Let's Encrypt SSL certificate (R12), which provides HTTPS encryption but does not validate legitimacy. The page title, 'Earn rewards when you get started on OKX | My referral code: 83671829 | OKX United States,' explicitly references OKX and includes a referral code, suggesting an attempt to lure victims into a reward-based scam. The domain is classified as a brand impersonation threat, specifically utilizing an 'Airdrop Scam' phishing kit. Detected technologies include Nginx, React, OpenResty, and analytics tools such as Naver Analytics and Google Tag Manager, which may be employed to track victim interactions or evade detection. As of July 12, 2026, the domain remains active, returning an HTTP 302 redirect status, which may indicate dynamic routing to evade automated analysis. It appears on one security blocklist, and 15 of 91 security vendors on VirusTotal flag the domain as malicious. The Gridinsoft trust score of 0/100 further corroborates its high-risk classification. Defenders are advised to block the domain and its resolving IP at the network level, monitor for related infrastructure (e.g., nameservers, hosting provider), and alert users to the presence of this referral-based scam targeting OKX customers. The exact content and functionality of the site remain unconfirmed, but the available indicators align with known phishing tactics in the cryptocurrency space.