okx-web3-tron-usdt-trc20-000000471[.]pages[.]dev

PhishDestroy identifies okx-web3-tron-usdt-trc20-000000471.pages.dev as an active brand impersonation scam targeting OKX users. The domain masquerades as an OKX Web3 wallet interface to deceive victims into connecting cryptocurrency wallets and authorizing fraudulent TRC20 USDT transactions. No drainer kit artifacts are visible in the current payload, suggesting reliance on social engineering and fake wallet interfaces instead of automated theft scripts.

Technical indicators confirm the threat: VirusTotal shows 5/95 detection engines flagged the site as malicious, indicating it remains under the radar of most antivirus systems. The domain resolves to IP 172.66.44.140 and is registered through Cloudflare, Inc., with an SSL certificate issued by Google Trust Services. As a Cloudflare Pages deployment, the domain benefits from Cloudflare's infrastructure while avoiding traditional hosting-based detection methods.

While currently active and unblocked by major services, the domain's risk profile remains under investigation. Users should immediately blacklist this domain and avoid any interaction. Blocking at the network level via IP 172.66.44.140 is recommended until cloud-based takedown processes complete. Remaining risk includes continued circulation through social media and phishing campaigns, with potential for drainer kit integration if the current campaign proves successful.