web3-okx-next04[.]pages[.]dev

Analysis of the domain web3-okx-next04.pages.dev indicates a confirmed brand impersonation campaign targeting OKX, a cryptocurrency exchange. The domain, registered through Cloudflare, Inc. on February 21, 2026, resolves to the IP address 172.66.45.28, hosted on Cloudflare's infrastructure (AS13335) in the United States. The SSL certificate, issued by Google Trust Services (WE1), and nameservers jake.ns.cloudflare.com and holly.ns.cloudflare.com further confirm Cloudflare as the hosting and registrar provider. Infrastructure checks reveal the domain was flagged by PhishDestroy and appears on at least one security blocklist.

VirusTotal detection data shows 5 of 93 security vendors classified the domain as malicious, though the specific nature of the threat remains unverified beyond its classification as a crypto scam. The domain's HTTP status returned a 403 Forbidden response at the time of analysis, and Cloudflare's page title explicitly labeled it as a 'Suspected phishing site.' Technologies detected include HSTS and HTTP/3, consistent with Cloudflare's standard security and performance configurations. No evidence of a phishing kit or additional malicious infrastructure was identified in the available data. The domain's trust score, as assessed by Gridinsoft, is 0/100, reinforcing its high-risk classification.

Defenders should treat this domain as compromised and prioritize blocking or monitoring access to it. Given its current offline status, further analysis of the site's content is not possible, but the available indicators align with known patterns of cryptocurrency-related phishing campaigns targeting exchange users. Organizations should review logs for connections to 172.66.45.28 and the domain itself, particularly in contexts involving OKX branding or cryptocurrency transactions.