okx-web3-usdt-trc20-payfor-00000104[.]pages[.]dev

This domain is flagged for brand impersonation, specifically targeting the cryptocurrency exchange platform OKX. The website poses a significant threat as it mimics the official OKX website to deceive users into providing sensitive information such as login credentials, personal data, and financial details. Visiting this site could lead to unauthorized access to user accounts, financial loss, and potential identity theft.

Analysis indicates that the domain okx-web3-usdt-trc20-payfor-00000104.pages.dev was created on April 28, 2026, and is registered through Cloudflare, Inc. The domain currently has an SSL certificate issued by Google Trust Services, which may give users a false sense of security. Despite being listed on one security blocklist, the domain has not been flagged by any of the 95 security vendors on VirusTotal, indicating that it is under active investigation and may not yet be widely recognized as malicious. The IP address 172.66.44.89, located in California, USA, is associated with Cloudflare, Inc., further suggesting the use of a reputable hosting service to lend credibility to the impersonation.

If a user has visited this site, they should immediately change their OKX account password and enable two-factor authentication (2FA) if not already active. Users should also monitor their financial accounts for any unauthorized transactions and report any suspicious activity to their bank or financial institution. It is recommended to run a full system scan using updated antivirus software and to contact a cybersecurity professional if any signs of compromise are detected. Reporting the incident to the official OKX support team and the relevant authorities can also help in mitigating the potential damage and preventing further incidents.