okx-web3-tron-usdt-trc20-000000816[.]pages[.]dev

PhishDestroy identifies active brand impersonation targeting OKX via the malicious domain okx-web3-tron-usdt-trc20-000000816.pages.dev. The threat is currently under investigation but remains operational, posing a significant risk to cryptocurrency users. The domain leverages Cloudflare’s infrastructure to masquerade as OKX’s official TRON-USDT (TRC20) interface, potentially facilitating crypto drainer attacks. Users who interact with this fraudulent page risk unauthorized fund transfers to attacker-controlled wallets. This domain was flagged with 0 detections out of 95 VirusTotal scans as of the latest analysis. It resolves to IP 172.66.47.79 and utilizes a Google Trust Services SSL certificate to enhance credibility. The domain is hosted on Cloudflare Pages, a legitimate service repurposed for malicious ends. Notably, the combination of a low VT score, legitimate resolver IP, and trusted certificate underscores the sophisticated evasion tactics employed by this campaign. No blocklist confirmations were detected at this stage, suggesting a recently deployed or highly targeted operation. Mitigation requires immediate blacklisting of the domain and associated IP. Organizations should update DNS filters and endpoint rules to block okx-web3-tron-usdt-trc20-000000816.pages.dev and 172.66.47.79. Users must verify OKX’s official domains (okx.com) before engaging with TRON-USDT services and enable wallet transaction alerts. Security teams should monitor for similar impersonation domains leveraging Cloudflare Pages or Google’s trust infrastructure. Immediate incident response is critical to curb potential fund losses.