okx-web3-usdt-trc20-0000000000000002[.]pages[.]dev

This domain is flagged as active crypto wallet drainer infrastructure impersonating OKX, a major cryptocurrency exchange platform. The site presents itself as a legitimate OKX Web3 USDT (TRC-20) transaction portal, likely designed to trick users into connecting their wallets to malicious smart contracts. Once connected, these contracts may execute unauthorized transactions, draining funds from victims' crypto wallets without consent. The domain specifically targets users familiar with TRC-20 token standards, increasing the likelihood of successful compromise among Tron network users.

Analysis indicates the domain was registered on March 31, 2026, through Cloudflare, Inc., and currently resolves to IP address 172.66.44.167. Despite its recent creation date, the domain has already been added to one security blocklist. VirusTotal shows 0 detections out of 95 security engines, suggesting the infrastructure remains undetected by most vendors. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of legitimacy to potential victims. The page title explicitly displays 'OKX,' reinforcing the brand impersonation tactics.

Users who have visited this domain or connected a wallet to it should immediately revoke any smart contract approvals associated with the site. This can be done through wallet interfaces or blockchain explorers by checking token approvals for suspicious addresses. Affected individuals should also transfer remaining funds to a new wallet address and monitor all connected accounts for unauthorized transactions. If credentials were entered, all passwords should be changed immediately, and multi-factor authentication enabled on all crypto-related accounts. Security teams are advised to block the domain and associated IP address within network security controls.