web3-okx-trc20-usdt-welll[.]pages[.]dev

The domain web3-okx-trc20-usdt-welll.pages.dev is currently under investigation for brand impersonation targeting OKX, a cryptocurrency exchange platform. Analysis indicates the domain is actively hosting phishing content designed to deceive users into disclosing sensitive credentials or transferring digital assets under false pretenses. The threat type is classified as brand impersonation, with a specific focus on mimicking OKX’s TRC20 USDT transaction interfaces. Infrastructure analysis reveals the domain resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335). Despite its active status, the domain has not been flagged by any of the 95 vendors on VirusTotal, though it appears on one security blocklist. The domain is registered through Cloudflare, Inc., and its SSL certificate is issued by Google Trust Services (WE1). No creation date is publicly available, but the domain remains operational and accessible. Current status confirms the domain is still active and poses an ongoing risk to users. Organizations and individuals are advised to block the domain at the DNS or network level, particularly in environments handling cryptocurrency transactions. End-users should verify the authenticity of any OKX-related communications or interfaces by cross-referencing official channels. Monitoring for additional detections or blocklist updates is recommended, as the domain’s low detection rate may change with further scrutiny.