# okx-web3-usdt-trc20-payfor-00000012.pages.dev — SUSPICIOUS

> okx-web3-usdt-trc20-payfor-00000012.pages.dev linked to crypto brand impersonation. Currently flagged by 0 of 95 VirusTotal vendors. Avoid interaction.

## Summary
PhishDestroy identifies okx-web3-usdt-trc20-payfor-00000012.pages.dev as a live domain actively impersonating the OKX brand to distribute a crypto drainer. The threat is under investigation and remains unblocked by most sandboxes. Users are advised not to engage with links or credentials requested by this domain.


This domain was flagged by 0 of 95 VirusTotal vendors at the time of detection, indicating no detections from leading antivirus engines. It resolves to IP address 172.66.44.191, is registered through Cloudflare, Inc., and uses a Google Trust Services SSL certificate. The domain is part of the Cloudflare Pages.dev infrastructure, leveraging reputable hosting to evade blocklists.


This domain remains active and poses a direct threat to users expecting legitimate OKX services. Users should immediately avoid any interaction, including visiting the site or entering credentials. Security teams should block the domain at network and endpoint levels and monitor for related IOCs. Further investigation is ongoing to determine scope and additional payloads.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: OKX

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.44.191

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/fce45543-74e3-424f-b73c-42a97fcd140f
- PhishDestroy: https://phishdestroy.io/domain/okx-web3-usdt-trc20-payfor-00000012.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/okx-web3-usdt-trc20-payfor-00000012.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/okx-web3-usdt-trc20-payfor-00000012.pages.dev/
Last updated: 2026-03-28