okx-web3-usdt-trc20-payfor-00000028[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting OKX cryptocurrency users. Analysis indicates the infrastructure is designed to deceive victims into transferring USDT-TRC20 tokens to attacker-controlled wallets under the pretense of legitimate OKX web3 services. Infrastructure analysis reveals the following technical indicators: the domain was created on March 28, 2026, and is currently active. It resolves to IP address 172.66.44.173, hosted on Cloudflare infrastructure in Canada. The domain is registered through Cloudflare, Inc., and appears on one security blocklist. Google Safe Browsing explicitly flags it as phishing, while VirusTotal shows 13 out of 95 security vendors detecting malicious activity. The SSL certificate is issued by Google Trust Services (WE1), a common pattern observed in phishing domains leveraging legitimate CDN services. To mitigate this threat, users should avoid interacting with the domain entirely. Cryptocurrency holders should verify all transaction requests through official OKX channels only, using bookmarked URLs or the verified mobile application. Network administrators should implement DNS-based blocking for this domain and monitor for connections to 172.66.44.173. Security teams should treat any credentials or wallet addresses associated with this domain as compromised and initiate internal incident response procedures for affected users. The domain's use of Cloudflare hosting suggests potential fast-flux techniques, warranting continuous monitoring for related infrastructure.