okx-web3-tron-usdt-trc20-000000228[.]pages[.]dev

Analysis shows that the sub‑domain okx-web3-tron-usdt-trc20-000000228.pages.dev was registered on 20 Nov 2024 via Cloudflare’s registrar and resolves to 188.114.97.3, an IP owned by AS13335 (Cloudflare, Inc.) located in the United States. The site serves HTTP 200 responses and presents an SSL certificate issued by Google Trust Services to WE1, indicating a valid TLS chain. Automated scans reveal the page title “OKX”, matching the declared brand target, and the domain is classified as a brand‑impersonation campaign. VirusTotal reports four detections out of ninety‑one scanners, and the Gridinsoft trust score is 0/100, confirming a malicious reputation. The hosting stack includes jQuery, HSTS, and HTTP/3 under Cloudflare’s CDN, and the domain appears on a single public blocklist. PhishDestroy has already added the host to its blocklist. The combination of a high‑profile brand, a functional TLS certificate, and an active Cloudflare front‑end makes the domain a credible phishing vector. Defenders should immediately add the full host name to DNS‑based and proxy blocklists, monitor for outbound connections to the underlying IP address, and consider extending threat‑intel feeds with this indicator. Ongoing observation is advised to detect any evolution of the payload or credential‑harvesting pages that may be deployed behind the current static front‑end.