cn[.]ocagent[.]io

Analysis of cn.ocagent.io shows the domain was created on June 03, 2026 and is registered through Dynadof Inc. The domain resolves to the IPv4 address 108.138.26.88 and is delegated to the name servers harvey.ns.cloudflare.com, lindsey.ns.cloudflare.com, ns-1453.awsdns-53.org, and ns-167. The domain is currently listed as active and has been blocked by the PhishDestroy repository; it also appears on a single external security blocklist. VirusTotal records indicate that the domain has been examined by 91 scanning vendors, none of which have raised a detection at the time of this assessment.

No public evidence of SSL/TLS configuration, HTTP status codes, page titles, or Safe Browsing alerts is available in the supplied intelligence, leaving the exact web content and credential‑harvesting mechanisms unverified. The lack of visible detections does not imply safety, and the absence of additional intelligence means the threat actor’s infrastructure and target profile remain uncertain.

Defenders should treat the domain as hostile: block the domain and its resolved IP at perimeter firewalls and DNS resolvers, continue to monitor for any changes in detection status on VirusTotal and other reputation services, and consider feeding the observed indicators into internal threat‑intel platforms. Ongoing observation of the hosting environment, especially Cloudflare and AWS name‑server usage, is recommended to detect potential redeployment or pivoting activities.