imtokennft[.]com

PhishDestroy identifies imtokennft.com as a brand impersonation domain targeting OKX users, currently under active investigation for suspected crypto drainer activity. The domain mimics OKX’s branding to trick users into connecting malicious wallets or entering credentials, posing a direct risk to cryptocurrency holdings. While the exact drainer kit remains unverified, the operational setup—domain, SSL, and infrastructure—suggests a sophisticated attempt to exploit trust in a major exchange.

Technical indicators confirm this domain’s malicious potential: VirusTotal shows 1/95 detections, indicating undetected malware or phishing payloads; it resolves to IP 201.5.252.176; the SSL certificate is issued by TrustAsia Technologies, Inc.; it was registered through TuringSign Inc. d/b/a Cosmotown on March 23, 2026; and it is not currently flagged in Google Safe Browsing (GSB) or major blocklists. The domain’s recent creation, clean VT score, and absence from blocklists suggest it may be newly deployed and still evading detection.

The domain remains active and unblocked, with current risk assessed as 'under_investigation' but functionally active. PhishDestroy continues to monitor and assess the threat, while users are advised to avoid interacting with imtokennft.com and verify any OKX-related links using PhishDestroy’s real-time scanner. Remaining risk is high due to the domain’s active status, lack of detection, and impersonation of a trusted brand like OKX. Users should treat all unsolicited links to 'imtokennft.com' as high-risk and report for immediate blocking.