everyworld-token[.]pages[.]dev

This domain, everyworld-token.pages.dev, operates as a confirmed cryptocurrency phishing endpoint specifically designed to impersonate OKX, a major digital asset exchange. Analysis indicates the infrastructure is engineered to harvest user credentials, private keys, or two-factor authentication codes through fraudulent login portals or wallet connection prompts. The domain mimics legitimate OKX branding elements, including logos, color schemes, and interface layouts, to deceive users into disclosing sensitive account information or authorizing malicious transactions via compromised smart contracts. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on June 08, 2026, and remains actively hosted on the same platform. At the time of assessment, the endpoint is flagged by 4 out of 95 security vendors on VirusTotal, indicating detection by a subset of endpoint protection systems. The domain appears on three distinct security blocklists, including specialized cryptocurrency threat intelligence feeds. The registrar’s infrastructure, while legitimate in primary use, provides anonymity and rapid deployment capabilities that are frequently exploited for short-lived phishing campaigns. Users who have interacted with everyworld-token.pages.dev should immediately revoke any connected wallet authorizations and reset credentials for all associated accounts, particularly those linked to OKX or other cryptocurrency services. It is recommended to conduct a full system scan using updated security tools to detect potential malware or browser-based persistence mechanisms. Affected individuals should monitor transaction histories for unauthorized activity and report the incident to relevant financial and cybersecurity authorities. Given the high-risk nature of this endpoint, all interactions with the domain should be treated as a potential compromise of sensitive authentication materials.