okxccoin[.]com

This domain, okxccoin.com, is under investigation for brand impersonation targeting OKX, a cryptocurrency exchange. Registered on April 22, 2026, through Gname.com Pte. Ltd., the domain resolves to the IP address 188.114.97.3, which is associated with Cloudflare, Inc. in Canada. The page title 'OKXN' suggests an attempt to mimic the OKX brand, though the exact content and functionality of the site remain unconfirmed. Infrastructure analysis reveals the use of Cloudflare nameservers (anirban.ns.cloudflare.com and walk.ns.cloudflare.com), along with technologies such as HSTS, Cloudflare Browser Insights, and HTTP/3, which are consistent with modern phishing operations leveraging CDN services to obscure origin servers and evade detection. The domain currently returns an HTTP 200 status, indicating it is active and accessible. It is flagged on one security blocklist, specifically PhishDestroy, but no detections were reported by the 94 vendors that scanned it on VirusTotal. The absence of detections does not confirm the domain's legitimacy, as phishing sites often evade initial scans through obfuscation or delayed malicious payloads. The SSL certificate is issued by Google Trust Services (WE1), a common practice among both legitimate and malicious sites to encrypt traffic and appear credible. Defenders should treat this domain as high-risk due to its registration details, Cloudflare-hosted infrastructure, and association with a known cryptocurrency brand. Monitoring for changes in behavior, such as shifts in IP resolution, SSL certificate updates, or additional blocklist inclusions, is recommended. If the domain is confirmed to host phishing content, takedown requests should be directed to the registrar (Gname.com Pte. Ltd.) and Cloudflare’s abuse channels. Further analysis of the site’s content and network traffic patterns is necessary to determine the full scope of the threat.