okx-web3-tron-usdt-trc20-000000906[.]pages[.]dev

This domain, okx-web3-tron-usdt-trc20-000000906.pages.dev, is flagged as a high-risk cryptocurrency phishing site impersonating the OKX cryptocurrency exchange platform. Analysis indicates the site employs brand impersonation tactics, specifically targeting users through fraudulent TRC20 USDT transaction prompts, likely designed to harvest wallet credentials or execute unauthorized fund transfers. The page title 'OKX' further corroborates the intent to deceive users into believing the site is an official OKX web3 portal. Infrastructure analysis reveals the domain was registered on March 30, 2026, through Cloudflare, Inc., and currently resolves to the IP address 172.66.44.71, hosted on Cloudflare's infrastructure in California. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing campaigns to lend false legitimacy. Detection metrics show 5 out of 95 security vendors on VirusTotal have flagged the domain, while it appears on a single security blocklist. Google Safe Browsing status remains unconfirmed at this time, but the domain is actively blocked by at least one anti-phishing service. As of the latest verification, the domain remains active and continues to pose a significant threat to users. Immediate response actions include blacklisting the domain across security platforms, revoking SSL certificates where feasible, and notifying the hosting provider for takedown. Despite these measures, the remaining risk persists due to the domain's operational status and the targeted nature of the phishing scheme. Users are advised to verify all transaction requests through official OKX channels, enable multi-factor authentication, and avoid interacting with any unsolicited cryptocurrency-related communications. Organizations should update endpoint protection rules to block the domain and associated IP address to mitigate potential credential theft or financial loss.