migratefegtokens[.]pages[.]dev

migratefegtokens.pages.dev is an active phishing domain leveraging OKX brand impersonation to harvest user credentials and sensitive financial data. The campaign poses a high risk due to its sophisticated infrastructure and low detection rates on VirusTotal. PhishDestroy’s analysis confirms this domain is part of a targeted operation designed to deceive users into revealing login credentials under the guise of a legitimate OKX token migration tool. PhishDestroy identifies this domain as a threat due to multiple red flags: it resolves to Cloudflare IP 172.66.44.153, uses a Google Trust Services SSL certificate, and currently shows 2/95 detections on VirusTotal, indicating no automated defenses have flagged it. Registered via Cloudflare, Inc., the domain employs Pages.dev, a legitimate Cloudflare service, to host malicious content while evading blocklists. The absence of detections suggests either a recent deployment or the use of evasion techniques to bypass scanners. Additional telemetry is required to determine if this domain exists on any public blocklists, but its infrastructure and SSL provider warrant immediate scrutiny. Mitigation for users encountering this domain involves immediate avoidance of any links or attachments associated with migratefegtokens.pages.dev. Users should report the domain to their email provider, browser security extensions, and relevant financial institutions (e.g., OKX) to prevent credential theft. Organizations are advised to implement DNS filtering to block access to this domain and monitor for outbound connections to 172.66.44.153. For the threat of brand impersonation, users should verify the legitimacy of any communication purporting to be from OKX by contacting the exchange directly via official channels, particularly when financial transactions or credential entry are involved.