okx-web3-tron-usdt-trc20-000000406[.]pages[.]dev

PhishDestroy identifies okx-web3-tron-usdt-trc20-000000406.pages.dev as an active brand impersonation scam masquerading as OKX’s TRON USDT TRC20 platform. This domain employs deceptive naming to trick users into transferring funds to attacker-controlled wallets, posing a direct financial risk. The threat level is elevated due to the combination of impersonation tactics and active hosting infrastructure. This domain was flagged by 6 of 95 VirusTotal security vendors, indicating early-stage but recognized malicious activity. It was registered through Cloudflare, Inc., resolving to IP 172.66.47.77 with a Google Trust Services SSL certificate. The domain leverages Cloudflare Pages for hosting, a common tactic to evade detection, while the SSL certificate adds a veneer of legitimacy. No additional blocklist references were provided, but the low VT detection ratio suggests this scam may be newly operational or employing evasion techniques. Mitigation requires immediate action: block the domain and IP at the network perimeter, update endpoint detection rules to flag the URL, and warn users about the impersonation scheme. For crypto-related scams, advise users to verify URLs via official OKX channels and avoid unsolicited TRC20 transfer requests. Monitor for related domains using the seed d8b2c0 for pattern matching.