okx-web3-tron-usdt-trc20-000000486[.]pages[.]dev

This domain, okx-web3-tron-usdt-trc20-000000486.pages.dev, is flagged for high-risk brand impersonation targeting OKX, a major cryptocurrency exchange. Analysis indicates the site mimics OKX’s Web3 wallet interface, specifically referencing TRC20 USDT transactions, a common vector for crypto drainer schemes. The page title explicitly displays 'OKX,' reinforcing the attempt to deceive users into interacting with fraudulent wallet or transaction prompts. No direct evidence of a specific drainer kit was observed, but the domain’s structure and naming convention suggest intent to harvest credentials or private keys under false pretenses. Infrastructure analysis reveals the domain was registered on April 4, 2026, through Cloudflare, Inc., and resolves to IP address 172.66.47.109, geolocated to California. The SSL certificate is issued by Google Trust Services (WE1), a common practice for malicious domains leveraging Cloudflare’s proxy services to obscure origin servers. As of the latest scan, 9 out of 95 security vendors on VirusTotal detect the domain as malicious, while it appears on one security blocklist. The domain remains unlisted by Google Safe Browsing, indicating a potential gap in automated detection coverage for newer or rapidly rotating threats. The domain remains active and continues to resolve, posing an ongoing risk to users searching for OKX-related services, particularly those involving TRC20 token transactions. Response actions should include immediate blacklisting by enterprise security tools, browser-level blocking, and takedown requests to Cloudflare Pages under their abuse policies. Users are advised to verify domain authenticity via official OKX channels before entering credentials or connecting wallets. Due to the domain’s use of Cloudflare’s infrastructure, origin server identification may require additional forensic analysis, such as DNS history or certificate transparency logs, to mitigate future iterations of this campaign.