imtoketn[.]im

PhishDestroy has identified imtoketn.im as an active brand impersonation phishing domain currently targeting OKX users. This domain was created on February 21, 2026, and is registered through a redacted registrar. The page title displays 'Suspected phishing site | Cloudflare,' indicating that the site may have been flagged or taken down by Cloudflare, but the domain remains accessible. The threat level is elevated, and the domain is actively being used for phishing campaigns.

Security analysis reveals that imtoketn.im is flagged by 18 out of 95 VirusTotal vendors, and it appears on 2 security blocklists. It has been found in 15 AlienVault OTX threat intelligence pulses. The domain resolves to IPv6 address 2606:4700:3034::6815:28a8 and uses an SSL certificate issued by Google Trust Services (WE1). These indicators strongly suggest malicious intent, with the domain impersonating the OKX brand to steal user credentials or sensitive information.

Given the active status and elevated risk, users should avoid any interaction with imtoketn.im. PhishDestroy recommends blocking this domain on network security appliances and reporting it to relevant authorities. Users who may have accessed the site should change their OKX passwords immediately and enable two-factor authentication. Always verify URLs before entering credentials, and rely on official OKX channels for transactions.