okxpoll[.]net

This domain, okxpoll.net, is under investigation for brand impersonation targeting OKX, a cryptocurrency exchange. Registered on May 3, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain remains active as of July 12, 2026. Infrastructure analysis reveals it is hosted behind Cloudflare, resolving to the IP address 172.67.175.219, located in Canada. The domain uses Cloudflare nameservers (alec.ns.cloudflare.com and betty.ns.cloudflare.com) and presents a Let's Encrypt SSL certificate with the serial number prefix E8. Current HTTP responses return a 403 status, indicating access restrictions, though this does not preclude malicious activity behind the scenes. The domain appears on one security blocklist and has been flagged by at least one threat intelligence source, as evidenced by its inclusion in a single AlienVault OTX pulse. Despite this, VirusTotal reports zero detections out of 95 engines, suggesting the domain has not yet been widely recognized as malicious by automated scanning tools. The Gridinsoft trust score of 0/100 further indicates a lack of confidence in its legitimacy, though this metric alone does not confirm malicious intent. Defenders should treat this domain with caution due to its association with brand impersonation and its presence on security blocklists. The use of Cloudflare infrastructure may complicate attribution and analysis, as it obscures the true origin of the hosting environment. While the domain has not yet triggered widespread detection, its creation date, registration details, and association with OKX warrant monitoring for phishing or credential harvesting activity. Network defenders are advised to block or monitor traffic to this domain, particularly in environments where OKX services are used, until further analysis confirms its status.