imtoken-wallet-review[.]pages[.]dev

PhishDestroy identifies the domain imtoken-wallet-review.pages.dev as an active brand impersonation campaign targeting OKX users. This domain is part of a broader threat operation leveraging deceptive naming conventions to mislead victims into interacting with malicious content. While no drainer kit has been retrieved or analyzed at this stage, the domain’s naming and infrastructure alignment strongly suggest the use of a crypto drainer or similar fraudulent toolkit designed to siphon digital assets under the guise of a legitimate service. The threat actor’s choice of branding reflects a deliberate attempt to exploit trust in the OKX ecosystem.

This domain resolves to IP 172.66.47.100 and is registered through Cloudflare, Inc. The SSL certificate is issued by Let's Encrypt, indicating the use of a publicly trusted certificate authority. VirusTotal currently reports 0 detections out of 95 security vendors, placing it below immediate detection thresholds despite clear malicious intent. The domain was recently registered and remains unlisted on Google Safe Browsing (GSB) as of this analysis. Blocklist aggregation services have not yet flagged this domain, likely due to its recent deployment and low historical reputation.

The investigation into imtoken-wallet-review.pages.dev remains active as of this report. Immediate response actions include domain takedown requests to Cloudflare and coordination with hosting providers. Users are advised to avoid interacting with this domain or any associated links. Remaining risk is assessed as high due to the domain’s active status, unflagged reputation, and impersonation of a major cryptocurrency exchange. Proactive monitoring and DNS-based blocking are strongly recommended to mitigate exposure.