wwwgrowthnode[.]systems

This domain wwwgrowthnode.systems is flagged under brand_impersonation targeting OKX with scam type listed as Fake Exchange. Registration occurred on April 11 2026 through Dynadot Inc using nameservers ns1.dyna-ns.net and ns2.dyna-ns.net. The domain resolves to IP 54.215.31.113 located in AWS EC2 us-west-1 region and presents an SSL certificate issued by Let's Encrypt R13. Current HTTP status returns 302 with a recorded page title stating Earn rewards when you get started on OKX My referral code 49758894 OKX Europe. The phishing kit associated is Airdrop Scam.

Detection metrics show appearance in 1 AlienVault OTX pulse and on 1 security blocklist. VirusTotal records 2 out of 95 vendors flagging the domain while Gridinsoft assigns a trust score of 0 out of 100. The domain remains listed as active with a note that it is blocked by PhishDestroy. These indicators are drawn directly from the provided intelligence without additional external confirmation.

Uncertainties remain around the exact redirect destination and full page content since direct site analysis is not available. The combination of the specific page title referencing OKX referral code 49758894 the 302 status and the Airdrop Scam kit label establishes the impersonation vector but does not confirm ongoing payload behavior or victim interaction volume.

Defenders should incorporate the exact domain wwwgrowthnode.systems the IP 54.215.31.113 and the Dynadot nameservers into blocklists and monitoring rules. Continued observation of the 302 responses and cross-reference against the single OTX pulse and blocklist entry supports prioritization. Regular checks for status changes after the July 12 2026 report date are recommended given the active classification.