# vmmtoken.pages.dev — SUSPICIOUS

> vmmtoken.pages.dev impersonates OKX brand. VirusTotal detection: 0/95. Verify sender URLs before crypto transactions. Act now.

## Summary
vmmtoken.pages.dev is currently under active investigation for brand impersonation targeting OKX, a major cryptocurrency exchange. The domain is a Cloudflare Pages-hosted site resolving to IP 188.114.97.3, registered through Cloudflare, Inc. The threat involves deceiving users into interacting with a fake OKX interface to steal credentials or cryptocurrency assets. Despite zero detections on VirusTotal (0/95 engines), the site lacks legitimacy and poses a direct risk to users who may confuse it with the official OKX platform.

PhishDestroy identifies this domain as a high-risk brand impersonation threat based on multiple indicators: it resolves to IP 188.114.97.3, uses a Google Trust Services SSL certificate, is hosted on Cloudflare Pages, and has not been flagged by VirusTotal despite its malicious intent. The domain’s structure (pages.dev subdomain) is commonly exploited for phishing due to its legitimate association with Cloudflare’s platform, which attackers abuse to host malicious content under a seemingly trustworthy domain. The absence of detections (0/95) suggests either low coverage by security vendors or a recently deployed attack, both of which increase user exposure.

Mitigation for this brand impersonation threat requires immediate user vigilance and organizational blocking. Users should verify all URLs against official OKX domains (okx.com) and avoid interacting with pages.dev subdomains claiming OKX affiliation. Organizations should block vmmtoken.pages.dev at the network level and update blocklists to include this domain using its IP (188.114.97.3) and SSL certificate issuer (Google Trust Services). Additionally, report the domain to Google Safe Browsing, VirusTotal, and OKX’s abuse teams to accelerate takedown efforts. Until confirmed safe, treat this domain as malicious and do not engage.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: OKX

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/550df933-be88-4701-bf9a-2f1af890bb3a
- PhishDestroy: https://phishdestroy.io/domain/vmmtoken.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/vmmtoken.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/vmmtoken.pages.dev/
Last updated: 2026-03-28