okx-web3-tron-usdt-trc20-000000589[.]pages[.]dev

This domain operates as a high-risk brand impersonation scheme targeting cryptocurrency users through fake OKX wallet interfaces. Analysis indicates the page specifically mimics OKX's Web3 functionality, presenting a fraudulent TRC-20 USDT transaction portal under the title 'OKX.' The infrastructure is designed to deceive users into transferring digital assets to attacker-controlled addresses by replicating legitimate exchange workflows with high visual fidelity. Infrastructure analysis reveals multiple technical indicators supporting this classification. The domain was registered through Cloudflare, Inc. on March 31, 2026, and currently resolves to the IP address 172.66.45.8, located in Canada. Detection metrics show 8 of 95 security vendors on VirusTotal have flagged this domain as malicious, while one commercial blocklist (PhishDestroy) has already incorporated it into their filtering systems. The SSL certificate, issued by Google Trust Services (WE1), provides basic transport encryption but does not validate legitimacy. Users who have interacted with okx-web3-tron-usdt-trc20-000000589.pages.dev should immediately revoke any connected wallet permissions and transfer remaining funds to new, verified addresses. All credentials entered on this domain should be considered compromised and changed across all platforms. Cryptocurrency transactions initiated through this interface are irreversible and should be reported to relevant blockchain analysis services for potential tracing. Continuous monitoring of connected devices for unauthorized access attempts is recommended for 30 days following exposure.