08pf[.]cn

The domain 08pf.cn was observed targeting the cryptocurrency exchange brand OKX through a brand‑impersonation campaign. The domain, registered on March 28 2025 by 成都伊索信息科技有限公司, resolves to the IP address 156.226.74.60, which is allocated to AS135097 LUOGELANG (FRANCE) LIMITED and geolocated in Hong Kong. The DNS configuration lists ns1.judns.com and ns2.judns.com as authoritative nameservers. A TLS certificate issued by Let’s Encrypt (R10) was present at the time of analysis, indicating that the site offered HTTPS connectivity. The page title retrieved before the site was taken offline reads “欧易下载|欧易app下载注册官网|欧易交易所下载注册|虚拟货币交易 - 欧易交易所下载”, confirming the use of Chinese language and the appearance of OKX‑related keywords.

Reputation checks show a Gridinsoft trust score of 0 / 100 and a Google Safe Browsing classification of social engineering. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal scans recorded 14 detections out of 95 scanned engines, reinforcing the malicious assessment. No additional public intelligence such as OTX references or malware kit identifiers were available.

The site is currently offline, limiting direct observation of payloads or credential‑collection mechanisms. Consequently, the exact content delivered to victims, including potential login forms or malicious binaries, remains unverified. Nonetheless, the convergence of registrar data, IP hosting, SSL provisioning, and multiple independent threat‑intel signals provides strong evidence that the domain was employed for brand‑impersonation phishing against OKX users.

Defenders are advised to enforce network‑level denial of 08pf.cn and its associated IP 156.226.74.60, update endpoint detection rules with the observed Safe Browsing and VirusTotal signatures, and monitor for any resurgence of the domain or similar registrant patterns. Continuous observation of the LUOGELANG AS block and the judns.