# imtoken-phone.com — MALICIOUS

> Stay vigilant against imtoken-phone.com, a fake OKX wallet site. Avoid entering personal info and verify URLs carefully to protect your assets.

## Summary
PhishDestroy identifies imtoken-phone.com as a high-risk brand impersonation domain targeting the OKX cryptocurrency platform. This malicious domain aims to deceive users by mimicking the OKX brand to potentially harvest sensitive information.

The domain was registered on February 21, 2026, via Dominet (HK) Limited and resolved to IP 23.235.135.183. It displayed a page titled "imToken official website｜Ethereum and Bitcoin blockchain wallet," adding to its deceptive appearance. VirusTotal flagged this domain with 11 detection alerts and it also appears on one security blocklist, confirming its suspicious nature.

Currently, the domain is offline, reducing immediate risk. Users are advised to avoid interacting with imtoken-phone.com and always verify URLs when accessing wallet services. PhishDestroy recommends employing updated security tools and exercising caution to prevent falling victim to such impersonation attempts.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Target brand: OKX
- Page title: imToken official website｜Ethereum and Bitcoin blockchain wallet

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Expires: 2026-10-12 00:00:00
- Registrar: Dominet (HK) Limited
- Country: HK
- IP: 23.235.135.183
- IP Country: HK
- IP City: Tung Chung
- IP Org: AS132839 POWER LINE DATACENTER
- Nameservers: ns1.domainnamedns.com ns2.domainnamedns.com ns3.domainnamedns.com ns4.domainnamedns.com
- SSL Issuer: none

## Detection Status
- VirusTotal: 11 vendors flagged
  Vendors: ["alphaMountain.ai", "CRDF", "Emsisoft", "Fortinet", "G-Data", "Kaspersky", "Netcraft", "Seclookup", "SOCRadar", "Sophos", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019c24c2-05d3-7089-ae70-1adcea02fdcd.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/ccd7afcf-92c2-497a-817d-ac840c8f023d
- Wayback Machine: https://web.archive.org/web/https://imtoken-phone.com
- PhishDestroy: https://phishdestroy.io/domain/imtoken-phone.com/
- LLM endpoint: https://phishdestroy.io/domain/imtoken-phone.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/imtoken-phone.com/
Last updated: 2026-03-19