pay-for-usdt-trc20-000289[.]pages[.]dev

This domain, pay-for-usdt-trc20-000289.pages.dev, operates as a high-risk crypto drainer phishing site targeting users through PayPal brand impersonation. The site presents a fraudulent interface designed to trick victims into authorizing USDT (TRC-20) token transfers under the guise of a legitimate payment or reward system. Analysis of the page title, which displays 'OKX'—a cryptocurrency exchange—suggests an attempt to exploit trust in both PayPal and crypto platforms, likely to drain digital assets from connected wallets once victims interact with malicious smart contracts or approve unauthorized transactions. Technical indicators confirm the malicious nature of this domain. The site is flagged by 15 out of 95 security vendors on VirusTotal, indicating broad detection across multiple threat intelligence platforms. It was registered through Cloudflare, Inc. on April 09, 2026, and currently resolves to the IP address 172.66.46.220, hosted under Cloudflare’s infrastructure. The domain appears on one security blocklist, and Google Safe Browsing has flagged it for social engineering. The SSL certificate is issued by Google Trust Services, which, while not inherently malicious, is commonly leveraged by threat actors to lend a false sense of legitimacy to phishing pages. Gridinsoft’s trust score of 0/100 further corroborates the domain’s high-risk classification. Users who visited this domain or interacted with its content should take immediate action to mitigate potential compromise. First, revoke any wallet approvals or smart contract interactions conducted through the site, particularly those involving USDT (TRC-20) tokens. Use a blockchain explorer to audit recent transactions and identify unauthorized transfers. Reset credentials for any accounts accessed while on the site, especially those linked to financial or cryptocurrency services. Monitor connected wallets and bank accounts for suspicious activity, and consider reporting the incident to relevant financial institutions or cybersecurity response teams. If personal or financial data was entered, enable additional security measures such as two-factor authentication and fraud alerts.