okx-web3-usdt-trc20-payfor-00000093[.]pages[.]dev

The domain okx-web3-usdt-trc20-payfor-00000093.pages.dev is flagged as a brand impersonation phishing site targeting OKX, a prominent cryptocurrency exchange platform. Analysis confirms the domain was actively impersonating OKX to deceive users into disclosing sensitive credentials or transferring digital assets under fraudulent pretenses. The site is currently offline, though prior activity aligns with known phishing tactics exploiting cryptocurrency-related services. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., with an SSL certificate issued by Google Trust Services. It resolves to the IP address 188.114.97.3 and was created on April 20, 2026, an anomalous future date suggesting potential domain spoofing or misconfiguration. The domain appears on one security blocklist and is flagged by 12 of 95 security vendors on VirusTotal. Additional technical indicators include the use of jQuery, HTTP/3, HSTS, and Cloudflare technologies, which are consistent with modern phishing infrastructure designed to evade detection. The Gridinsoft trust score for this domain is 0 out of 100, reinforcing its classification as high-risk. Given the elevated risk level and confirmed brand impersonation, this domain should be treated as malicious. Organizations and users are advised to block all connections to 188.114.97.3 and the associated domain at the network level. Security teams should review logs for prior interactions with this infrastructure and monitor for similar phishing domains using the same registrar or IP range. If financial transactions or credential submissions occurred, immediate remediation steps—including password resets, transaction reversals, and account audits—are strongly recommended. Proactive threat hunting for related indicators of compromise is encouraged to mitigate further exposure.