okx-web3-usdt-trc20-payfor-00000108[.]pages[.]dev

PhishDestroy identifies okx-web3-usdt-trc20-payfor-00000108.pages.dev as an active brand-impersonation site targeting OKX users with a crypto-drainer kit that prompts victims to connect wallets and transfer USDT via TRC20. The page title “OKX” and the inclusion of terms like “USDT-TRC20” in the domain indicate a deliberate attempt to deceive users seeking legitimate OKX services. No unique drainer kit signature has been publicly released yet, suggesting either a custom script or reused open-source code.

Technical indicators place this domain at high risk: VirusTotal shows 0/95 detections despite active abuse, it resolves to IP 188.114.96.3, and uses a Google Trust Services SSL certificate for added legitimacy. Registered through Cloudflare on an unknown date, the domain already appears on two public blocklists and is blocked by MetaMask and SEAL. Its Google Safe Browsing status remains unflagged, maintaining attacker advantage.

As of the latest scan, the domain is still active and distributing the drainer payload. Immediate response includes domain takedown requests, IP de-listing, and browser warning submissions. While current risk remains under investigation, the combination of zero detections, active distribution, and dual blocklist presence warrants urgent caution for users and immediate action by security teams.