oyu[.]red

The domain oyu.red has been identified as a brand impersonation phishing resource targeting OKX, a prominent cryptocurrency exchange platform. Analysis confirms the domain is designed to deceive users by mimicking legitimate OKX referral reward pages, as evidenced by the page title 'Earn rewards when you get started on OKX | My referral code: 49758894 | OKX Europe.' The domain is currently offline, though prior activity indicates a deliberate attempt to harvest user credentials or referral codes under false pretenses.

Infrastructure analysis reveals the domain was registered through Dynadot Inc on April 11, 2026, and resolves to the IP address 54.215.31.113. Detection metrics indicate elevated risk: 13 of 95 security vendors on VirusTotal flagged the domain, while Gridinsoft assigned a trust score of 0 out of 100. The domain appears on one security blocklist and is referenced in a single AlienVault OTX threat intelligence pulse. Detected technologies include Nginx, React, OpenResty, ThreatMetrix, OneTrust, Naver Analytics, HSTS, and Google Tag Manager, alongside a Let's Encrypt SSL certificate, suggesting an attempt to appear legitimate through modern web infrastructure.

Current status confirms the domain has been taken offline, though residual risk remains due to its prior use in phishing operations. Organizations and users are advised to block the domain and associated IP address at the network level. Security teams should monitor for similar impersonation attempts, particularly those leveraging referral reward themes. End users should verify the authenticity of any OKX-related communications by cross-referencing official domains and avoiding interaction with unsolicited reward offers.