okx-web3-tron-usdt-trc20-000000265[.]pages[.]dev

The domain okx-web3-tron-usdt-trc20-000000265.pages.dev is currently active and hosts a page titled "OKX", indicating a direct impersonation of the OKX brand. Infrastructure analysis shows the site resolves to IP 172.66.44.54, a server located in Canada and fronted by a CDN provider. The TLS certificate is issued by a widely recognized certificate authority (Google Trust Services / WE1), and the service enforces HTTP Strict Transport Security and HTTP/3. Technical fingerprints reveal the presence of jQuery and standard web technologies. The domain was registered on 20 November 2024 through the same CDN provider and uses the nameservers brian.ns.cloudflare.com and elma.ns.cloudflare.com. Reputation signals are poor: a Gridinsoft trust score of 0 out of 100 and a Google Safe Browsing classification of SOCIAL_ENGINEERING. The domain appears on a security blocklist (PhishDestroy) and has an HTTP 200 response, suggesting the content is being served. No malware detections are reported by scanning services, but the absence of detections does not guarantee safety. Defenders should block the domain at network perimeter, monitor DNS queries for the exact name, and consider adding it to internal threat intelligence feeds. Continuous re‑evaluation is advised, as the page content has not been publicly reviewed and may evolve.