xn--imtoken-171l1499b[.]shop

This domain, xn--imtoken-171l1499b.shop, is identified as a brand impersonation threat targeting OKX, a cryptocurrency exchange platform. Analysis indicates the infrastructure was designed to mimic legitimate OKX wallet services, likely to deceive users into disclosing credentials or transferring assets. The domain does not appear to host a known drainer kit at this time, but its design and naming convention strongly suggest intent to exploit trust in the OKX brand. Infrastructure analysis reveals the domain was registered on July 4, 2025, through Chengdu West Dimension Digital Technology Co., LTD. It resolves to the IP address 198.18.43.56 and is currently flagged by 17 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and is blocked by at least one threat intelligence feed. No SSL certificate is present, and the domain has not been listed on Google Safe Browsing as of the latest verification. The domain has since been taken offline, reducing immediate risk to users. However, the registration details and infrastructure remain active, indicating potential for re-deployment. Users who interacted with the domain prior to its takedown should assume credential exposure and monitor accounts for unauthorized activity. Organizations are advised to maintain blocklist updates and educate users on recognizing impersonation tactics targeting cryptocurrency platforms.