okx-web3-trx-trc20--000000009[.]pages[.]dev

The domain okx-web3-trx-trc20--000000009.pages.dev was registered on April 01, 2026 and is currently active. Its page title resolves to “OKX”, matching the brand target OKX, indicating a brand‑impersonation campaign. The site returns HTTP 200 and is hosted behind Cloudflare, which also provides the SSL certificate issued by Google Trust Services (WE1). Infrastructure analysis shows the domain resolves to the IP address 188.114.97.3, which is geolocated to Canada and is owned by Cloudflare, Inc. The authoritative nameservers are bill.ns.cloudflare.com and irena.ns.cloudflare.com. The site advertises the use of jQuery, HTTP/3, HSTS, and Cloudflare services. A Gridinsoft trust score of 0 out of 100 further confirms the malicious nature. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. No detections were recorded on VirusTotal (0/95), but the absence of detections does not imply safety given the confirmed brand‑impersonation indicators. The page content has not been publicly examined, so the exact payload or credential‑collection mechanisms remain unknown. The presence of a valid SSL certificate and modern protocols may be intended to increase user trust, while the use of Cloudflare obscures the true origin of the hosting infrastructure. Defenders should add the domain to outbound and inbound filtering rules, enforce DNS‑based blocklists that include the observed entry, and monitor for any connections to 188.114.97.3. Continuous scanning of the associated IP range and the two Cloudflare nameservers is advised. Incident response teams should treat any traffic from this domain as potentially malicious and advise users to avoid interacting with any OKX‑related prompts originating from the site.