revokes-aero-com[.]pages[.]dev

This domain, revokes-aero-com.pages.dev, is flagged as a high-risk brand impersonation phishing site targeting OKX, a major cryptocurrency exchange platform. Analysis indicates the domain was designed to deceive users into believing they are interacting with legitimate OKX services, likely aiming to harvest credentials or facilitate unauthorized transactions. No specific drainer kit signatures were identified in initial scans, but the infrastructure aligns with known phishing campaigns impersonating financial and crypto-related services. Infrastructure analysis reveals the following technical indicators: the domain is detected by 11 out of 95 security vendors on VirusTotal, indicating moderate to high confidence in malicious classification. It is registered through Cloudflare Pages, a platform frequently abused for rapid deployment of phishing sites due to its ease of use and free hosting capabilities. The domain resolves to the IP address 172.66.47.91, associated with Cloudflare’s network infrastructure. The creation date of the domain is listed as March 25, 2026, which is anomalous and suggests either a typo-squatting attempt or an error in registration records. The SSL certificate is issued by Google Trust Services, providing a false sense of security to potential victims. The domain appears on four security blocklists, including MetaMask, PhishDestroy, SEAL, and ScamSniffer, further corroborating its malicious intent. Google Safe Browsing status was not explicitly provided but is likely flagged given the blocklist presence. As of the latest assessment, the domain has been taken offline, reducing immediate exposure to potential victims. However, the infrastructure and registration details suggest that the threat actors may redeploy similar phishing campaigns using comparable domains or hosting providers. Remaining risks include the potential for cloned or mirrored versions of the site to resurface under different domains, particularly those leveraging Cloudflare Pages or similar services. Users and organizations are advised to monitor for domains with similar naming patterns, enforce blocklist updates, and implement real-time domain reputation checks. Additionally, cryptocurrency users should verify the authenticity of any platform requesting credentials or transaction approvals, particularly those impersonating OKX or other high-profile exchanges.