imtoken-frontpage[.]net

PhishDestroy identifies the domain imtoken-frontpage.net as an active brand impersonation threat targeting OKX users. This site mimics the official OKX frontage, likely deployed to harvest credentials or deploy a crypto drainer kit. The domain’s naming leverages the trusted 'imToken' wallet brand to deceive visitors into believing they are accessing a legitimate OKX interface. No confirmed drainer kit signatures are present in available feeds, but the threat actor’s intent remains high-risk due to the impersonation of a major cryptocurrency exchange. This domain was flagged on March 19, 2026, with a VirusTotal detection ratio of 12/95 engines, indicating it is currently undetected by most antivirus platforms. It resolves to IP 154.221.182.147, registered through Dominet (HK) Limited using a TrustAsia SSL certificate. Google Safe Browsing (GSB) has not yet flagged this domain, and no public blocklist entries were found at time of analysis. The threat remains active and under investigation as of seed 371d31. Users are advised to block access at the network level and avoid interaction. Security teams should monitor for further infrastructure pivots, especially given the 12/95 VT score and absence from GSB. Remaining risk is assessed as elevated due to the impersonation tactic and undetected status on major threat platforms.