okx-web3-usdt-trc20-payfor-00000088[.]pages[.]dev

The domain okx-web3-usdt-trc20-payfor-00000088.pages.dev is a sophisticated brand impersonation attack targeting OKX users. It mimics the legitimate OKX platform to trick victims into connecting their crypto wallets, thereby deploying a crypto drainer that siphons funds from TRC20 USDT and other assets. The page title is set to "OKX" to appear authentic, but this is a phishing site designed to steal login credentials and private keys.

Technical analysis reveals alarming indicators. VirusTotal flags this domain with 12 out of 95 security vendors marking it as malicious, confirming widespread detection across the cybersecurity community. The domain was registered on March 30, 2026, through Cloudflare, Inc., a common registrar for phishing sites due to its free and fast provisioning. It currently resolves to IP address 172.66.44.251 and appears on one security blocklist, while Google Safe Browsing specifically flags it as phishing. Despite the relatively low blocklist count, the high detection rate on VirusTotal and active status underscore the imminent threat.

If you have visited or interacted with this domain, take immediate action. Disconnect any wallets that may have been connected, revoke token approvals on blockchain explorers, and change passwords for any accounts that used the same credentials. Run a full antivirus scan on your device and monitor your crypto wallets for unauthorized transactions. Report the domain to OKX support and Google Safe Browsing. For ongoing protection, use PhishDestroy to verify any new OKX-related URLs before engaging.