web3okx-okx-okxt-08[.]pages[.]dev

This domain, web3okx-okx-okxt-08.pages.dev, is flagged as a high-risk brand impersonation threat targeting OKX, a major cryptocurrency exchange platform. Analysis indicates the infrastructure is designed to mimic legitimate OKX services, likely to deceive users into disclosing sensitive credentials or transferring digital assets to attacker-controlled wallets. The domain exhibits characteristics consistent with phishing campaigns, including the use of brand-specific subdomains and Cloudflare-hosted infrastructure to evade detection and enhance credibility. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.66.44.175, hosted under Cloudflare, Inc. (AS13335). It was registered on October 22, 2024, through Cloudflare’s registrar services. Security vendor assessments on VirusTotal show 5 out of 95 engines flagging the domain as malicious. The domain appears on one security blocklist and is associated with an SSL certificate issued by Google Trust Services (WE1). No Google Safe Browsing (GSB) detections are currently recorded, though this may reflect latency in propagation rather than absence of risk. As of the latest assessment, the domain remains active and unresolved in public blocklists beyond the single detection noted. Response actions should include immediate submission to additional threat intelligence platforms, monitoring for related domains using similar naming conventions, and proactive takedown requests to the hosting provider. Despite partial vendor detection, the domain poses a significant residual risk due to its active status, brand-aligned naming, and use of reputable infrastructure providers to mask malicious intent. Users and organizations are advised to block resolution at the DNS level and treat any interaction with this domain as a potential security incident.