okx-web3-usdt-trc20-payfor-00000096[.]pages[.]dev

This domain okx-web3-usdt-trc20-payfor-00000096.pages.dev is assessed as a brand impersonation phishing page targeting OKX. The infrastructure is structured to simulate a Web3 payment or USDT TRC20 transfer flow, likely intended to trick users into authorizing transactions or exposing wallet credentials under the guise of legitimate OKX-related operations. The page title is reported as 'OKX', indicating deliberate brand mimicry to increase trust and engagement from unsuspecting users.

Technical analysis shows VirusTotal detection at 0/95, indicating no current vendor flags despite malicious indicators. The domain was created on November 02 2024 and is registered through Cloudflare, Inc., with SSL issued by Google Trust Services / WE1. It resolves to IP 172.66.44.150 and is currently active. The domain appears on 1 security blocklist and is explicitly blocked by PhishDestroy, reinforcing external detection of malicious behavior despite low automated scoring.

At the time of assessment, the domain remains active, increasing exposure risk for users who may encounter it through messaging, redirects, or spoofed advertisements. Although VirusTotal shows no detections (0/95), the combination of confirmed brand impersonation, active blocklist presence, and known phishing behavior suggests high operational risk. Users who interacted with the site should assume potential credential or wallet compromise, revoke any connected session approvals, rotate passwords if entered, and move digital assets to a secure environment. Continued monitoring and network-level blocking are recommended due to its active status and evolving detection profile.