imtokensy[.]net

PhishDestroy identifies the domain imtokensy.net as an active brand impersonation threat posing as the legitimate cryptocurrency exchange OKX. The domain is currently classified as an elevated-risk entity and remains operational as of the latest assessment. This operation leverages the OKX brand to deceive users into transferring cryptocurrency to attacker-controlled wallets, a technique commonly referred to as a crypto drainer. This domain was flagged by 1 of 95 VirusTotal security vendors, indicating limited but credible detection coverage. It resolves to IP address 154.221.182.157 and is registered through Dominet (HK) Limited. The SSL certificate is issued by TrustAsia Technologies, Inc., a certificate authority that has been associated with fraudulent issuance in past campaigns. The domain was created on March 19, 2026, suggesting a very recent deployment. Despite its newness, this threat shows operational maturity in its impersonation strategy. As of this analysis, imtokensy.net remains active with an elevated risk profile. Due to its active status, the domain continues to pose a significant threat to users who may mistake it for the legitimate OKX platform. Security researchers and end-users are strongly advised to avoid interacting with this domain and to report it through their browser’s safe browsing tools or to local cybersecurity teams. Organizations are encouraged to update their threat intelligence feeds with this indicator to prevent accidental exposure. Immediate domain blocking at the network perimeter is recommended to mitigate risk of user compromise.