okx-web3-tron-usdt-trc20-000000590[.]pages[.]dev

Analysis of okx-web3-tron-usdt-trc20-000000590.pages.dev shows an active brand impersonation campaign targeting the OKX brand. The site returns HTTP 200 and presents a page title of "OKX", indicating intent to mimic the legitimate service. Infrastructure details reveal registration through Cloudflare, Inc. on April 06, 2026 and resolution to IP 172.66.47.109, which is owned by Cloudflare and geolocated to Canada. The domain uses the Google Trust Services / WE1 SSL certificate, providing a valid TLS handshake despite malicious intent. Threat intelligence indicates the domain is blocked by PhishDestroy and appears on one security blocklist; Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification. VirusTotal reports 10 of 94 scanners flagging the domain, confirming detection by multiple vendors. Nameservers are ishaan.ns.cloudflare.com and lara.ns.cloudflare.com, typical of Cloudflare-hosted domains. While the exact payload or credential‑harvesting mechanisms have not been publicly disclosed, the combination of a legitimate‑looking page title, brand targeting, and multiple security detections warrants immediate defensive action. Organizations should add the domain and its resolving IP to network deny lists, enforce URL filtering for the .pages.dev TLD, and monitor for similar Cloudflare‑hosted subdomains that reference OKX or related cryptocurrency terms. Continuous sampling of the site’s content is advised to detect any evolution of the attack vector.