im-token-official[.]net

PhishDestroy identifies im-token-official.net as an active brand impersonation domain targeting OKX. The domain has been classified as under investigation due to its suspicious activity mimicking the legitimate OKX brand. This impersonation poses a significant risk to users seeking genuine cryptocurrency services. This domain exhibits multiple indicators of malicious intent. Flagged by 16 of 95 VirusTotal vendors, it currently evades detection by major security solutions. Registered through Dominet (HK) Limited, the domain resolves to IP 154.221.182.148, which is associated with malicious activity. Created on March 19, 2026, the domain’s recent registration suggests a potential campaign targeting unsuspecting cryptocurrency users. TrustAsia Technologies, Inc. issued its SSL certificate, further legitimizing its appearance. Despite the lack of blocklist entries, the domain’s rapid creation and impersonation of a major brand warrant immediate scrutiny. As of the latest intelligence, this domain remains active and unblocked. PhishDestroy recommends immediate blacklisting of im-token-official.net and 154.221.182.148 at the network perimeter. Users should avoid interacting with this domain and verify all URLs before entering credentials. Additionally, security teams should monitor for similar domains leveraging the OKX brand. Enhanced monitoring for DNS resolutions to the associated IP is advised to prevent potential breaches.