web3-okx-next03[.]pages[.]dev

The domain web3-okx-next03.pages.dev is currently active and hosts a page titled “OKX”, indicating a brand impersonation of the cryptocurrency exchange OKX. The domain was registered on April 25 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned IP address 172.66.44.149 located in Canada. DNS resolution uses the Cloudflare authoritative nameservers holly.ns.cloudflare.com and jake.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services under the WE1 identifier, confirming the use of Cloudflare’s infrastructure. HTTP requests return status 200 and the site serves jQuery, enforces HSTS, and supports HTTP/3, consistent with a modern hosting stack. Security telemetry shows that eight of ninety‑one VirusTotal scanners have flagged the domain, and it is listed on one external blocklist. The domain is also blocked by the PhishDestroy mitigation service, and Gridinsoft assigns a trust score of zero out of one hundred. While the available data confirms the presence of brand‑impersonation infrastructure, the exact content of the page beyond the title has not been publicly analyzed, leaving the specific phishing mechanics unknown. Defenders should block the domain at DNS and proxy layers, monitor for connections to the IP 172.66.44.149, and include the domain in threat‑intelligence feeds. Additional investigation of the landing page is recommended to determine credential‑harvesting vectors and to update detection signatures.