okx-votings[.]xyz

This domain, okx-votings.xyz, was registered on 28 December 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to 172.67.158.244, an address owned by AS13335 Cloudflare, Inc. in the United States. The domain hosts no SSL certificate, and its authoritative name servers are gabriel.ns.cloudflare.com and surina.ns.cloudflare.com, both Cloudflare‑managed. The site presents the page title “OKX Token Voting | Vote on Crypto Listings,” directly referencing the OKX brand, which aligns with the intelligence that the domain impersonates OKX and is classified as a crypto‑scam. VirusTotal scans show that three of ninety‑three security vendors flagged the domain, and it appears on a single security blocklist.

PhishDestroy has also listed the domain as blocked. The combination of brand impersonation, a convincing voting‑related title, and the lack of HTTPS suggests an attempt to lure cryptocurrency users into a fraudulent voting or token listing process. Analysis indicates that the infrastructure relies entirely on Cloudflare’s network, which can obscure the backend server location but does not mitigate the brand‑spoofing risk. The absence of an SSL certificate may be intentional to avoid certificate‑based trust signals, while the domain’s recent creation date (less than seven months old) is typical for fast‑flux or opportunistic scams.

Current status shows the domain taken offline, yet historical activity may have already impacted victims. Defenders should continue to block okx-votings.xyz at network perimeter and DNS layers, ingest the indicator into threat‑intel feeds, and monitor for any re‑use of the same IP address or Cloudflare name servers in future campaigns. Given the explicit brand reference and the detection by multiple vendors, security teams are advised to treat any communications referencing “OKX Token Voting” as malicious until proven otherwise.