okx-web3-tron-usdt-trc20-000000430[.]pages[.]dev

PhishDestroy identifies okx-web3-tron-usdt-trc20-000000430.pages.dev as an active brand impersonation site targeting OKX, currently under investigation with status marked as active. The domain leverages Cloudflare’s infrastructure and a Google Trust Services SSL certificate to mimic legitimate OKX services, deceiving users into connecting crypto wallets or entering credentials under false pretenses.

This domain was flagged by 9 of 95 VirusTotal vendors as of the latest scan, indicating a low detection rate despite clear malicious intent. It resolves to IP 172.66.45.38, registered through Cloudflare, Inc., and utilizes a pages.dev subdomain under Cloudflare Pages, which is commonly abused for rapid deployment of fraudulent sites. The SSL certificate issued by Google Trust Services further enhances its credibility to unsuspecting victims, while the specific threat involves brand impersonation of OKX to facilitate cryptocurrency theft.

Given the active status and zero VirusTotal detections, this site poses an immediate risk to users interacting with OKX-related services. PhishDestroy recommends blocking access to okx-web3-tron-usdt-trc20-000000430.pages.dev at the network and DNS levels. Users should verify URLs carefully, avoid clicking suspicious links, and report such domains to OKX and relevant cybersecurity platforms. Monitor for updates as this investigation progresses.