okx-web3-tron-usdt-trc20-000000891[.]pages[.]dev

Analysis of okx-web3-tron-usdt-trc20-000000891.pages.dev shows a high‑risk brand impersonation targeting the OKX brand. The domain was registered on March 30, 2026 and resolves to IP 172.66.44.140, which is owned by Cloudflare, Inc. and geolocated to Canada. The site is served over HTTPS with a Google Trust Services / WE1 certificate, and the HTTP response status is 200. Page title is "OKX", matching the declared brand target, and the threat type is explicitly listed as brand impersonation. Infrastructure details include Cloudflare nameservers jean.ns.cloudflare.com and wesley.ns.cloudflare.com, and the presence of jQuery, HSTS, Cloudflare, and HTTP/3 in the technology stack. Reputation signals are poor: Gridinsoft assigns a trust score of 0/100, VirusTotal reports 7 of 94 security vendors flagging the domain, and it appears on one security blocklist. The domain has been blocked by PhishDestroy but remains active. Defenders should treat the domain as malicious, enforce DNS or firewall deny rules, and monitor outbound connections to the associated IP. Because no page content was examined, the exact phishing or credential‑harvesting mechanisms are unknown, but the combination of a legitimate‑looking title, brand name, and malicious reputation suggests a high likelihood of credential theft or fraud. Continuous telemetry collection and periodic re‑assessment are recommended to detect any changes in payload or hosting infrastructure.