okx-web3-usdt-trc20-payfor-00000090[.]pages[.]dev

PhishDestroy identifies okx-web3-usdt-trc20-payfor-00000090.pages.dev as an active brand impersonation threat under investigation. This malicious domain mimics OKX’s legitimate services to deceive users into processing fraudulent TRC20 USDT transactions.

This domain exhibits multiple red flags: VirusTotal analysis shows 0 detections out of 95 scanners as of current data, indicating evasion of automated defenses. Registered through Cloudflare, Inc., it resolves to IP 172.66.44.232 and leverages a Google Trust Services SSL certificate to appear legitimate. The Pages.dev platform suggests recent creation, though exact registration dates remain unverified at this stage. No blocklist entries have been recorded, further highlighting its stealthy nature.

Mitigation for this brand impersonation threat requires immediate user awareness and proactive blocking. Organizations should add the domain and associated IP (172.66.44.232) to firewall and DNS sinkhole rules to prevent access. Users should verify URLs against OKX’s official domains (okx.com) before engaging with payment-related prompts. Security teams are advised to monitor for similar typosquatting patterns targeting TRC20 or other crypto payment flows. Given the 4/95 detection ratio, manual review and threat hunting are critical to preempt broader exploitation.