okxdrainer[.]pages[.]dev

On 12 July 2026 the domain okxdrainer.pages.dev was identified as a high‑risk brand‑impersonation site targeting the cryptocurrency exchange OKX. The domain, created on 12 May 2025, resolves to the IP address 172.66.44.236 and serves a TLS certificate issued by Google Trust Services under the WE1 root. An HTTP request to the site returns a 500 status code and the page title “Worker threw exception | okxdrainer.pages.dev | Cloudflare”, indicating a failing Cloudflare worker.

The hosting infrastructure is provided entirely by Cloudflare, Inc. The domain uses the authoritative nameservers kenia.ns.cloudflare.com and apollo.ns.cloudflare.com and is assigned to ASN 13335, located in the United States. Detected technologies include HTTP/3 and HTTP Strict Transport Security (HSTS). Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, and the domain is listed on a single security blocklist operated by PhishDestroy.

VirusTotal analysis shows that 1 of 95 security vendors flagged the domain, reflecting limited detection coverage but not mitigating the evident threat. The site’s content is classified as a cryptocurrency‑related scam, consistent with the brand‑impersonation technique used to lure victims into fraudulent financial interactions. No additional malicious payloads have been observed, leaving the exact exploitation method uncertain.

Defenders should immediately block okxdrainer.pages.dev at network and endpoint layers, and add the associated IP address 172.66.44.236 to deny lists. Continuous monitoring of DNS queries for this domain and its Cloudflare nameservers is advised. User education campaigns should warn personnel about counterfeit OKX communications and recommend verification of URLs before any credential or crypto‑transfer submission.