okx-web3-tron-usdt-trc20-000000887[.]pages[.]dev

Analysis indicates that the domain okx-web3-tron-usdt-trc20-000000887.pages.dev was registered on March 30, 2026 and resolves to the Cloudflare‑managed IP 172.66.47.24, located in Canada. The site delivers an HTTP 200 response, presents the page title "OKX", and employs jQuery, HSTS, Cloudflare services and HTTP/3. The SSL certificate is issued by Google Trust Services under the WE1 profile, confirming a valid TLS chain. Gridinsoft assigns a trust score of 0 / 100, and the domain is listed on one security blocklist. It is currently flagged by PhishDestroy and remains active. The infrastructure is fully hosted through Cloudflare, with nameservers jean.ns.cloudflare.com and wesley.ns.cloudflare.com, and the domain was registered through Cloudflare, Inc. VirusTotal reports that 94 scanners have examined the site, none reporting a detection, though this does not constitute a safety assurance. The only confirmed malicious characteristic is its classification as a brand‑impersonation campaign targeting the OKX brand. Content beyond the page title has not been publicly disclosed, leaving the exact phishing mechanics uncertain. Defenders should prioritize blocking the fully qualified domain name at network perimeter devices, update URL filtering and DNS sinkhole rules, and monitor for any related Cloudflare‑associated IP addresses. Continuous observation of threat‑intel feeds for new indicators of compromise linked to this domain is recommended, as is verifying that internal authentication portals do not accept credentials from sites presenting the same title or similar branding.