okx-web3-tron-usdt-trc20-000000789[.]pages[.]dev

PhishDestroy identifies okx-web3-tron-usdt-trc20-0900000789.pages.dev as an active crypto drainer scam targeting OKX users. This domain was flagged for brand impersonation and is currently under investigation for malicious intent. The site mimics OKX’s TRC20 USDT withdrawal interface, likely designed to trick users into connecting wallets and draining cryptocurrency assets.

This domain exhibits multiple red flags: VirusTotal shows 10/95 detections despite active malicious behavior, indicating evasion of standard antivirus tools. It resolves to IP address 188.114.96.3, hosted through Cloudflare, Inc., and leverages a Google Trust Services SSL certificate to appear legitimate. The subdomain pattern (okx-web3-tron-usdt-trc20) mirrors OKX’s legitimate web3 service naming convention, suggesting deliberate deception. Notably, the domain remains unlisted on major blocklists such as Google Safe Browsing, PhishTank, and OpenPhish, enabling it to evade real-time detection systems.

To mitigate risk, users must avoid interacting with this domain entirely. Always verify URLs against official OKX channels and use PhishDestroy’s real-time domain lookup for confirmation. If you’ve already connected a wallet, immediately revoke permissions via your wallet’s connected apps settings and transfer remaining funds to a cold wallet. Report this domain to OKX’s abuse team and PhishDestroy to aid in takedown efforts.