okj-coin[.]com

The domain okj-coin.com was registered on November 19, 2025 and is currently listed as offline. It appears on a single security blocklist, specifically PhishDestroy, indicating that at least one anti‑phishing service has identified it as malicious. The domain resolves to the IP address 185.230.88.104, which is allocated to AS56485 TheHost LLC and geolocated to Ukraine. DNS resolution is provided by Cloudflare nameservers amanda.ns.cloudflare.com and amit.ns.cloudflare.com, a common pattern for fast‑flux or anonymized hosting.

The registrar information shows the domain was purchased through GRANSY S.R.O D/B/A SUBREG.CZ. No SSL certificate is present, leaving communications unencrypted and exposing visitors to potential credential harvesting. Gridinsoft assigns a trust score of 0 out of 100, reflecting a lack of reputation. VirusTotal scans have flagged the domain in 7 of 95 security vendor engines, reinforcing the suspicion of malicious activity.

The page title returned by the server is simply "okj-coin.com," offering no additional context about the content or targeted brand. While the exact phishing payload or lure has not been captured, the combination of blocklist inclusion, low trust score, unencrypted endpoint, and multiple vendor detections provides strong evidence that the domain was used for generic phishing. Defenders should ensure the domain is blocked at network perimeter devices, update URL filtering policies, and monitor for any resurgence of the host or related IP addresses. Continuous re‑evaluation of the host’s reputation is advised, as the infrastructure could be repurposed for future campaigns.