okx-web3-usdt-trc20-payfor-00000026[.]pages[.]dev

This domain, okx-web3-usdt-trc20-payfor-00000026.pages.dev, is actively impersonating the OKX cryptocurrency exchange platform as of July 12, 2026. Analysis indicates the domain was registered on March 28, 2026, through Cloudflare, Inc., and currently resolves to the IP address 188.114.96.3. The site is flagged for social engineering by Google Safe Browsing and is blocked by at least one security vendor, with a presence on one security blocklist. Twelve of ninety-five security vendors on VirusTotal detect this domain as malicious. The SSL certificate is issued by Google Trust Services, and the domain employs technologies including jQuery, HSTS, Cloudflare, and HTTP/3. Infrastructure analysis reveals the domain is hosted on Cloudflare Pages, a platform commonly used for both legitimate and malicious content. The subdomain structure, including terms like 'web3', 'usdt', and 'trc20', suggests an attempt to mimic cryptocurrency-related services, likely targeting users of the OKX platform. The page title explicitly displays 'OKX', reinforcing the brand impersonation. No specific phishing kit or additional infrastructure details are currently available. Defenders should treat this domain as high-risk due to its active status, brand impersonation, and detection by multiple security mechanisms. Immediate blocking at the network and endpoint levels is recommended. Given the domain's association with cryptocurrency terms, organizations handling digital assets should prioritize monitoring for user interactions with this domain and related infrastructure. Further investigation into the hosting environment and potential associated campaigns is advised.