imtokencbn[.]com

This domain is flagged as an elevated-risk brand impersonation threat targeting OKX, a major cryptocurrency exchange platform. The infrastructure is designed to deceive users into believing they are interacting with legitimate OKX services, likely for credential harvesting or fraudulent fund transfers. Analysis indicates the domain was operational despite its deceptive intent, as evidenced by its technical configuration and security vendor detections. Infrastructure analysis reveals the domain imtokencbn.com was registered on October 22, 2025, through Gname.com Pte. Ltd. It resolves to the IP address 154.219.125.3, hosted on AS8796 (FASTNET DATA INC) in the United States. The domain is secured with a Let's Encrypt SSL certificate (R12) and displays the page title '网站筹建中' (translated: 'Website under construction'). Security vendors on VirusTotal flagged the domain as malicious, with 17 out of 95 engines detecting it. Additionally, it appears on one security blocklist and was blocked by at least one anti-phishing service prior to being taken offline. Mitigation steps for this threat type include monitoring for residual DNS resolutions to 154.219.125.3, particularly within networks handling cryptocurrency transactions. Organizations should update blocklists to include the domain and its associated IP address, while also scrutinizing domains registered through Gname.com Pte. Ltd. with similar naming patterns or SSL configurations. End users should be educated on verifying domain authenticity before entering credentials, especially for financial or cryptocurrency platforms. Given the domain's current offline status, further investigation into the hosting provider (AS8796) may reveal additional malicious infrastructure linked to the same threat actor.