wap[.]imtokenzg[.]com

This domain, wap.imtokenzg.com, was identified as a phishing site targeting users of the OKX cryptocurrency exchange. The site was designed to mimic legitimate OKX wallet interfaces, likely to harvest login credentials, private keys, or other sensitive financial information from unsuspecting victims. Cryptocurrency phishing remains a high-impact threat due to the irreversible nature of blockchain transactions, making such domains particularly dangerous even after takedown. Analysis indicates the domain was registered on March 08, 2026, through Dominet (HK) Limited, a registrar frequently associated with malicious infrastructure. At the time of detection, the domain was flagged by 18 out of 95 security vendors on VirusTotal, confirming its classification as a phishing threat. It resolved to the IP address 160.124.198.74, hosted within AS132839 (POWER LINE DATACENTER) in Hong Kong, a network segment previously linked to fraudulent activity. The site presented a 404 error at the time of investigation, suggesting either a temporary takedown or a deliberate attempt to evade detection while maintaining operational readiness. Users who accessed wap.imtokenzg.com should assume potential exposure of sensitive credentials. Immediate actions include revoking any active sessions on OKX or associated wallets, rotating passwords, and enabling multi-factor authentication if not already active. Monitor linked accounts for unauthorized transactions and consider rekeying or migrating funds to a new wallet if private keys were entered. Security teams should block the domain and IP 160.124.198.74 at the network perimeter, and review logs for connections to this infrastructure. Given the elevated risk, affected users should report the incident to their exchange and relevant cybersecurity authorities for further mitigation.