web3okx-okx--okxct-56[.]pages[.]dev

Analysis as of July 24 2026 shows that the domain web3okx-okx--okxct-56.pages.dev was registered through Cloudflare, Inc. on October 23 2024 and resolves to the Cloudflare edge address 188.114.97.3, which is announced by AS13335 and located in the United States. The SSL certificate presented by the host is issued by Google Trust Services under the identifier WE1, and the server advertises HSTS and HTTP/3, indicating a modern Cloudflare deployment. The HTTP response returned a 403 status code and the page title reported by the server is “Suspected phishing site | Cloudflare”, matching the classification of a crypto‑scam that impersonates the OKX exchange. The domain is listed on the PhishDestroy blocklist and appears on one additional security blocklist; Gridinsoft assigns it a trust score of 0 out of 100.

VirusTotal scans flagged the domain in 7 of 95 security vendors, confirming that multiple detection engines consider it malicious. Nameserver records point to augustus.ns.cloudflare.com and erin.ns.cloudflare.com, consistent with the registrar’s Cloudflare infrastructure. The combination of a low trust score, multiple vendor detections, and explicit blocklist entries indicates a high likelihood that the site was used to lure cryptocurrency users by mimicking OKX branding.

The current offline status prevents immediate interaction, but the underlying IP address remains under Cloudflare control and could be reused for future impersonation campaigns. Defenders should continue to block the IP 188.114.97.3 at the network perimeter, add the fully qualified domain to URL filtering rules, and monitor for any re‑registration of similar subdomains under the pages.dev namespace. Continuous re‑scanning with VirusTotal and inclusion in threat‑intel feeds are recommended to capture potential re‑activations.