08pf[.]cn

PhishDestroy first observed 08pf.cn on Sep 3, 2025. Stored content metadata identifies OKX as the apparent target. The captured page title is “欧易下载|欧易app下载注册官网|欧易交易所下载注册|虚拟货币交易 - 欧易交易所下载”. Current evidence score: 92/100 (critical).

Positive findings are stored from 3 sources: VirusTotal, Google Safe Browsing, and Cloudflare Radar. VirusTotal recorded 14 detections among 95 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Google Safebrowsing, Lionic, Seclookup, Sophos, VIPRE, Webroot on Feb 23, 2026 at 05:28 UTC. Google Safe Browsing flagged the domain: Social Engineering on Feb 25, 2026 at 20:44 UTC. Cloudflare Radar classified the hostname as malicious and assigned the categories security threats and phishing; its verdict timestamp was not retained. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 10:20 UTC. URLQuery recorded no positive detection; no observation timestamp was retained. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 03:41 UTC.

Cloaking was recorded with HTTP 502 on Aug 7, 2026 at 01:08 UTC. The cloaking probe recorded status split conditional delivery at 1/100 on Aug 7, 2026 at 01:08 UTC: dead_http: raw=http_502; http=502; via=http_proxy. Registration records for the domain list 成都伊索信息科技有限公司 as the registrar and Mar 28, 2025 as the creation date. At collection time, the hostname resolved to 156.226.74.60 on AS135097 (MYCLOUD-AS-AP LUOGELANG FRANCE LIMITED, HK). The recorded endpoint location is Tung Chung, HK. The stored server header is nginx. DOM analysis on Apr 23, 2026 at 23:20 UTC returned 10/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists Let's Encrypt / R10 as the certificate issuer with validity through Oct 5, 2025; checked Mar 11, 2026 at 12:42 UTC.

The content indicators and 3 positive source findings support the current OKX impersonation and phishing classification. The target field identifies OKX, but the record does not establish whether the page requested credentials, a seed phrase, or a wallet connection.