jfd0jfdf[.]rurzokerze[.]workers[.]dev

This report details a malicious domain impersonating the cryptocurrency brand OKX. The site, jfd0jfdf.rurzokerze.workers.dev, presented a page titled "Suspected phishing site | Cloudflare," indicating it was flagged as a phishing threat. The domain posed as OKX, a cryptocurrency platform, and was categorized as a cryptocurrency scam type. The primary threat is credential theft, where victims are tricked into entering sensitive information under the guise of a legitimate service.

Technical analysis confirms the domain was created on 2026-02-21 and registered through Cloudflare, Inc. It resolved to IP address 104.21.58.133, located in the United States, associated with AS13335 Cloudflare, Inc. The SSL certificate was issued by Google Trust Services (WE1). VirusTotal analysis shows 9 out of 95 security vendors flagged the domain as malicious, with detections from BitDefender, CRDF, CyRadar, Fortinet, and G-Data. The domain appears on 1 blocklist. GridinSoft assigned a trust score of 0 out of 100, and the DOM risk score is 68.

The domain is currently reported as DOWN/OFFLINE, indicating it is no longer accessible. Based on the high DOM risk score of 68 and the zero trust rating from GridinSoft, this domain poses a significant risk. It should be blocked and avoided by all users and systems.