okx-web3-usdt-trc20-payfor-00000017[.]pages[.]dev

This domain presents a high-risk brand impersonation threat targeting users of the OKX cryptocurrency exchange platform. Analysis indicates the site mimics legitimate OKX wallet services, specifically referencing USDT-TRC20 transactions, a common vector for fraudulent deposit requests. The domain is designed to deceive users into entering sensitive credentials or transferring cryptocurrency under false pretenses, exploiting trust in the OKX brand to facilitate unauthorized access to digital assets. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on March 28, 2026, an anomalous future date suggesting potential manipulation of registration records. The domain resolves to IP address 172.66.44.131, hosted by Cloudflare, Inc. in Canada, and employs an SSL certificate issued by Google Trust Services (WE1). Security vendor detections on VirusTotal report 10 out of 95 engines flagging the domain as malicious, while it appears on one security blocklist, specifically PhishDestroy. The page title explicitly displays 'OKX,' further confirming the intent to impersonate the legitimate exchange. Users who have interacted with this domain should immediately revoke any active sessions associated with OKX or related cryptocurrency services. All credentials entered on the site must be considered compromised and should be changed from a secure, isolated device. Cryptocurrency wallet addresses used for transactions initiated through this domain should be reviewed for unauthorized transfers, and any suspicious activity reported to the legitimate platform. Continuous monitoring of financial accounts and device integrity is advised, as exposure to such threats may indicate broader targeting by malicious actors.