goompytokencollector[.]pages[.]dev

PhishDestroy identifies the domain goompytokencollector.pages.dev as an active brand impersonation threat targeting OKX users. Security analysts report the site is currently operational and under investigation for distributing a crypto drainer disguised as an OKX token collector. This domain was flagged by 0 of 95 VirusTotal vendors as of the latest scans, indicating it has yet to be widely recognized by detection engines despite its malicious intent. The domain was registered through Cloudflare, Inc., resolves to IP address 172.66.44.76, and operates under a Google Trust Services SSL certificate, which may contribute to initial credibility. While the threat remains active, immediate action is recommended. Users should avoid interacting with goompytokencollector.pages.dev and ensure their security tools are updated. Organizations are advised to block the domain at the network level and report its indicators to threat intelligence platforms for broader defense.