# okx-web3-usdt-trc20-payfor-00000005.pages.dev — SUSPICIOUS

> Danger: okx-web3-usdt-trc20-payfor-00000005.pages.dev is a fake OKX site pushing a USDT TRC-20 crypto drainer.

## Summary
PhishDestroy identifies okx-web3-usdt-trc20-payfor-00000005.pages.dev as an active USDT TRC-20 crypto drainer impersonating the OKX brand. Visitors are tricked into connecting wallets under the false promise of receiving USDT deposits, but the site instead drains tokens directly. The page leverages Cloudflare Pages hosting and a Google Trust Services SSL certificate to appear legitimate, while resolving to IP 172.66.44.81. Google Safe Browsing already flags this domain for social-engineering tactics.  This domain was flagged by PhishDestroy on seed d21903 with zero detections out of 95 VirusTotal scanners at the time of analysis. It was registered through Cloudflare, Inc. and remains under active investigation for brand impersonation. The use of a .pages.dev subdomain and “payfor” in the path mimics OKX’s legitimate web3 services, increasing the risk of user deception.  If you visited okx-web3-usdt-trc20-payfor-00000005.pages.dev, immediately revoke any wallet connections in your wallet’s “Connected Apps” or “DApp Browser” section. Do not enter seed phrases or private keys anywhere on the site. Run a full malware scan on your device. Report the domain to PhishDestroy for further blocking and share your experience to help warn others.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: OKX

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.44.81

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: FLAGGED
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/551e825f-e8ff-4e01-95bc-1e884787d477
- PhishDestroy: https://phishdestroy.io/domain/okx-web3-usdt-trc20-payfor-00000005.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/okx-web3-usdt-trc20-payfor-00000005.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/okx-web3-usdt-trc20-payfor-00000005.pages.dev/
Last updated: 2026-03-28