okx-web3-tron-usdt-trc20-000000806[.]pages[.]dev

On 25 July 2026, the domain okx-web3-tron-usdt-trc20-000000806.pages.dev was observed serving a page whose HTML title is “Suspected phishing site | Cloudflare”. The site presents a valid TLS certificate issued by Google Trust Services under the WE1 authority, indicating that the HTTPS connection is cryptographically authenticated. DNS resolution points the domain to the address 172.66.44.186, an IP owned by Cloudflare, Inc. and geolocated to California, United States. The HTTP response code returned is 403, which suggests that the server is actively denying access to generic requests, a behavior sometimes employed to hide malicious payloads from automated scanners. The domain was registered on 23 March 2026 through the Cloudflare Pages service, a platform frequently abused for rapid deployment of malicious front‑ends.

It is listed on a single security blocklist and has been specifically blocked by PhishDestroy, confirming that at least one external remediation service has taken action against it. Vendor‑based scanning on VirusTotal involved 94 engines, none of which flagged the domain at the time of analysis; the absence of detections does not constitute evidence of benign intent. Independent reputation scoring from Gridinsoft assigns a trust score of 0 / 100, indicating extreme suspicion. The site is categorized as a “Crypto Scam” and is explicitly linked to the OKX brand, implying an attempt to deceive users of that cryptocurrency exchange. Current intelligence does not disclose the exact content of the page beyond the title, nor any observed credential‑capture forms or transaction redirection mechanisms.

Consequently, the precise attack vector—whether credential harvesting, address substitution, or automated token transfer—remains uncertain.