okx-web3-tron-usdt-trc20-000000402[.]pages[.]dev

PhishDestroy has flagged okx-web3-tron-usdt-trc20-000000402.pages.dev as an active brand impersonation campaign targeting OKX users. This domain mimics official OKX web3 services, specifically the TRON USDT TRC20 interface, to deceive victims into connecting cryptocurrency wallets or entering login credentials. Upon access, the page likely prompts users to authenticate or approve transactions, functioning as a crypto drainer designed to siphon digital assets under false pretenses. The threat is currently under investigation but remains accessible and operational.

Investigations reveal this domain resolves to IP address 188.114.97.3 and operates behind Cloudflare’s infrastructure, with SSL certification issued by Google Trust Services. Notably, VirusTotal currently reports zero detections across 95 security engines, indicating this threat has not yet been widely recognized or blocked by automated defenses. The domain’s registration and use of Cloudflare suggest an attempt to cloak malicious activity while leveraging trusted certificate authorities to appear legitimate. This combination of evasion techniques lowers the barrier for successful victim engagement.

Users who have visited okx-web3-tron-usdt-trc20-000000402.pages.dev should immediately cease all interactions with the site and disconnect any connected wallets or accounts. Revoke any unauthorized permissions granted to the domain through wallet interfaces. Report the incident to OKX support and monitor accounts for unauthorized transactions. Use PhishDestroy to verify URLs before clicking and enable multi-factor authentication on all critical platforms. Stay vigilant for similar impersonation campaigns leveraging trusted brand names to exploit crypto users.