pay-for-usdt-trc20-000236[.]pages[.]dev

pay-for-usdt-trc20-000236.pages.dev is currently hosting a page titled “OKX”. The site returns HTTP 200 and resolves to the Cloudflare‑owned address 188.114.97.3, which is geolocated to Canada. Registration occurred on 27 April 2026 and the domain is served through Cloudflare’s DNS (alex... and lars...). TLS is provided by Google Trust Services under the WE1 certificate, and HTTP/3 with HSTS is observed. Front‑end libraries include jQuery, confirming the presence of typical web‑application components. The domain is listed on a single security blocklist (PhishDestroy) and is classified as a brand‑impersonation phishing campaign targeting the OKX brand. VirusTotal scans show 14 of 91 vendors flagging the host, and Gridinsoft assigns a trust score of 0 / 100, indicating a high likelihood of malicious intent. The infrastructure is fully cloud‑based, offering no direct host‑level indicators beyond the shared Cloudflare IP range. No additional intelligence such as malware payloads, command‑and‑control endpoints, or credential‑harvesting URLs has been disclosed. Defenders should block the domain at perimeter and DNS layers, monitor for outbound connections to 188.114.97.3, and include the domain in threat‑intel feeds. Because the site uses a valid TLS certificate, standard TLS inspection may be required to uncover any embedded malicious content. Continuous re‑evaluation is advised as further indicators may emerge.