imtoken[.]fakegucci[.]shop

The domain imtoken.fakegucci.shop has been identified as a brand impersonation threat targeting the cryptocurrency exchange OKX. This domain was likely used to deceive users into providing sensitive information or performing unauthorized transactions, potentially leading to financial loss or credential theft.

Infrastructure analysis reveals that imtoken.fakegucci.shop was registered through GoDaddy.com, LLC, and resolves to the IP address 52.128.227.170, which is located in Hong Kong and is associated with AS45753 Netsec Limited. The domain was created on February 21, 2026. VirusTotal reports that 10 out of 95 security vendors flag this domain as malicious. Additionally, the domain appears on one known security blocklist and is blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt, indicating the use of HTTPS to potentially create a false sense of security among users.

As of the latest assessment, the domain is currently offline, which suggests that it has been taken down or is no longer active. However, the remaining risk is elevated due to the domain's presence on security blocklists and the significant number of VirusTotal detections. Users are advised to remain vigilant and avoid accessing this domain or any similar domains that may impersonate OKX. Security teams should monitor for any reactivation of this domain and continue to block it to prevent potential harm to users.