okx-web3-tron-usdt-trc20-000000295[.]pages[.]dev

This domain, okx-web3-tron-usdt-trc20-000000295.pages.dev, is flagged as a high-risk brand impersonation site targeting OKX, a cryptocurrency exchange platform. Analysis indicates the domain mimics OKX’s Web3 and TRC20 USDT services, likely to facilitate credential theft or crypto wallet drainer attacks. The page title explicitly displays 'OKX,' reinforcing the impersonation attempt to deceive users into disclosing sensitive account or wallet information. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on April 20, 2026, and resolves to the IP address 172.66.47.10, hosted under Cloudflare, Inc. in Canada. The SSL certificate is issued by Google Trust Services (WE1). VirusTotal reports 7 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. Google Safe Browsing (GSB) status remains unconfirmed, but the domain is actively blocked by at least one threat intelligence feed. As of the latest verification, the domain remains active and unresolved, posing a continued risk to users. No takedown or sinkholing actions have been observed. Organizations and individuals are advised to block the domain and IP at the network level, update endpoint protection rules, and alert users to avoid interaction with any OKX-themed pages hosted on non-official domains. Monitoring for related infrastructure, such as newly registered Cloudflare Pages subdomains with similar naming patterns, is recommended to preempt further impersonation attempts.