okx-web3-usdt-trc20-payfor-00000103[.]pages[.]dev

Analysis indicates that the domain okx-web3-usdt-trc20-payfor-00000103.pages.dev is currently under investigation for brand impersonation targeting OKX, a cryptocurrency exchange. The domain was registered on April 30, 2026, through Cloudflare, Inc., and remains active as of July 12, 2026. Infrastructure analysis reveals it resolves to the IP address 188.114.97.3, which is associated with Cloudflare's network. The SSL certificate is issued by Google Trust Services, a common provider for both legitimate and malicious domains. The page title explicitly displays 'OKX,' aligning with the reported brand impersonation threat type. Detection data shows the domain appears on one security blocklist and is blocked by at least one vendor, though no detections were recorded across 95 vendors in a recent scan. The absence of detections does not confirm safety, as phishing domains often evade initial detection. Technologies identified on the domain include jQuery, HSTS, Cloudflare, and HTTP/3, which are consistent with both legitimate and malicious sites. Given the domain's recent registration, active status, and alignment with known impersonation tactics, defenders should treat it as high-risk until further analysis confirms its legitimacy. Organizations are advised to monitor for connections to this domain, particularly in environments where OKX-related services are used. Additional scrutiny of user reports or endpoint telemetry may provide further evidence of malicious activity.