okx-web3-usdt-trc20-payfor-00000059[.]pages[.]dev

PhishDestroy identifies okx-web3-usdt-trc20-payfor-00000059.pages.dev as an active brand impersonation domain targeting OKX users. This site masquerades as an official USDT TRC-20 payment portal, luring victims into connecting wallets or entering login credentials under the guise of facilitating transactions. The domain leverages OKX’s branding to exploit trust, a tactic increasingly common in crypto drainer campaigns. Threat actors behind this infrastructure aim to siphon cryptocurrency or harvest sensitive account details, posing severe financial and privacy risks to unsuspecting users. This domain was flagged with critical indicators: it shows 0 detections out of 95 scans on VirusTotal, indicating it remains undetected by most security engines as of the latest analysis. Registered via Cloudflare, Inc., it resolves to IP address 188.114.97.3 and operates under a Google Trust Services SSL certificate, which may help it evade initial suspicion. The domain is hosted on pages.dev, a service commonly abused for short-lived phishing operations. Such infrastructure choices reflect a deliberate strategy to remain operational long enough to ensnare victims before being reported and taken down. If you visited this domain, immediately revoke any connected wallet permissions through your wallet interface (e.g., MetaMask, Trust Wallet) and change your OKX account password. Do not interact with wallet connection prompts or input credentials. Report the domain to OKX via their official channels and update your system’s antivirus or DNS filtering rules to block 188.114.97.3. Exercise heightened caution with any unsolicited links claiming to offer crypto services—always verify URLs and use bookmarked official portals.