ouyizh[.]org

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting OKX, a cryptocurrency exchange platform. Analysis indicates the infrastructure was designed to deceive users through a fabricated referral program offering rewards, as evidenced by the page title containing a fake referral code (49758894) and explicit impersonation of OKX Europe branding. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain ouyizh.org was registered on April 11, 2026, through Dynadot Inc, and currently resolves to IP address 54.215.31.113. Security vendors flagged the domain on VirusTotal with 18/95 detections, while it appears on one security blocklist and holds a Gridinsoft trust score of 0/100. Additional indicators include a Let's Encrypt SSL certificate, detection in one AlienVault OTX threat intelligence pulse, and technologies such as Nginx, React, OpenResty, ThreatMetrix, and Google Tag Manager. The domain was subsequently taken offline but remains a documented threat in historical records. Mitigation against this specific threat type requires multi-layered verification. Users should cross-check domain registration dates against official brand domains, as legitimate exchange platforms typically maintain long-standing registrations. Any referral program should be validated through direct navigation to the official platform (avoiding search engine results) and confirmed via verified social media channels or customer support. Organizations should implement DNS-based blocking of the domain and its resolved IP address, while security teams should monitor for similar impersonation patterns including fabricated referral codes, Let's Encrypt certificates on newly registered domains, and React-based frontend frameworks in combination with OpenResty server configurations.