okx-web3-tron-usdt-trc20-000000050[.]pages[.]dev

The domain okx-web3-tron-usdt-trc20-000000050.pages.dev is actively engaged in brand impersonation targeting OKX, a major cryptocurrency exchange platform. Analysis indicates this is a high-risk threat designed to deceive users into disclosing wallet credentials or transferring TRC20 USDT tokens to attacker-controlled addresses. The domain remains operational as of the latest verification, posing an immediate risk to individuals interacting with cryptocurrency services. Infrastructure analysis reveals the domain was registered on November 16, 2024, through Cloudflare, Inc., and resolves to the IP address 172.66.44.113. Security vendor assessments show 13 of 95 engines on VirusTotal flag the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and fraudulent sites. The page title explicitly displays 'OKX,' reinforcing the impersonation attempt, and the domain structure mimics legitimate wallet or transaction identifiers. Current status confirms the domain remains active, requiring immediate mitigation. Organizations and individuals are advised to block the domain and its resolving IP at the network perimeter. Users should verify all cryptocurrency-related communications through official channels only, avoiding interaction with unsolicited links or prompts. Security teams are recommended to monitor for additional domains using similar naming patterns, particularly those combining 'okx,' 'web3,' 'tron,' or 'usdt' with numeric sequences. Proactive threat hunting should focus on TRC20 transaction logs for unauthorized transfers linked to this infrastructure.