okx-web3-usdt-trc20-00000000007[.]pages[.]dev

The domain okx-web3-usdt-trc20-00000000007.pages.dev is currently active and classified as a high-risk brand impersonation phishing site targeting OKX, a cryptocurrency exchange platform. Analysis confirms the domain is designed to deceive users into believing they are interacting with legitimate OKX services, as evidenced by the page title 'OKX' and the inclusion of cryptocurrency-related terms in the domain name. The threat type is explicitly categorized as brand impersonation, with the intent to harvest credentials or financial information from unsuspecting victims. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 30, 2026, and resolves to the IP address 188.114.97.3, geolocated to Canada under Cloudflare’s network. The domain is flagged by Google Safe Browsing as phishing and appears on at least one security blocklist. VirusTotal detection metrics indicate that 13 out of 95 security vendors have identified the domain as malicious. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing sites frequently leverage valid certificates to appear legitimate. As of the latest assessment, the domain remains active and continues to pose a significant threat. Organizations and end-users are advised to block access to this domain at the network level and implement real-time monitoring for related indicators of compromise. Users who may have interacted with this domain should immediately revoke any active sessions, reset credentials, and monitor for unauthorized transactions or account activity. Security teams are encouraged to correlate this domain with other known phishing infrastructure targeting cryptocurrency platforms to identify broader campaign patterns.