okx-web3-tron-usdt-trc20-000000118[.]pages[.]dev

The domain okx-web3-tron-usdt-trc20-000000118.pages.dev was registered on March 31, 2026 and is hosted behind Cloudflare infrastructure (IP 172.66.44.195, located in Canada). The site presents a page title of "OKX" and is classified as a brand impersonation campaign targeting the OKX brand. Technical fingerprints show the presence of jQuery, HTTP Strict Transport Security (HSTS), HTTP/3, and Cloudflare services, with a TLS certificate issued by Google Trust Services under the WE1 root. The domain appears on one security blocklist and is actively blocked by PhishDestroy, yet it remains reachable with HTTP status 200. Current risk level is listed as under_investigation and the infrastructure is still active. Defenders should treat the domain as a malicious impersonation vector, block network resolution to 172.66.44.195, enforce URL filtering for the exact domain, and monitor for related indicators such as the associated Cloudflare nameservers (koa.ns.cloudflare.com, megan.ns.cloudflare.com). Because the domain is newly created and lacks public detections, continuous observation is advised to detect any escalation or credential harvesting activity.