imtokenofficial-china[.]com

PhishDestroy identifies the domain imtokenofficial-china.com as an active brand-impersonation drainer targeting OKX users. Registered on October 8, 2025 via Dominet (HK) Limited, the site currently resolves to AS160.124.192.215 and carries a Let’s Encrypt SSL certificate to enhance credibility. The campaign is designed to harvest credentials under the guise of an official OKX wallet interface, leveraging a deceptive top-level string (“-china”) to lull victims into a false sense of authenticity. No known drainer kit signature has been publicly released yet, but the domain’s immediate setup strongly suggests a ready-to-deploy web inject or fake wallet clone is already in operation.

Technical indicators confirm both low detection coverage and rapid deployment tactics. VirusTotal scanning returns a score of 4 out of 95 engines detecting the domain as malicious, while Google Safe Browsing has not yet blacklisted the URL. The domain was created on October 8, 2025, which indicates a very recent registration window of less than one day at time of analysis. Hosting is provisioned on a single IPv4 address (160.124.192.215) located in Hong Kong, correlating with the registrar’s regional presence. The certificate, issued by Let’s Encrypt, further lowers user suspicion despite its generic nature.

Current status is active and under investigation, with no active blocklisting across public threat feeds. Response actions include real-time domain sinkholing coordination with Tier-1 DNS resolvers and outreach to the hosting provider’s abuse desk via Dominet (HK) Limited. Remaining risk remains high given the zero-detection state and the domain’s clear alignment with a high-value cryptocurrency exchange brand. Users are advised to verify all wallet domains against OKX’s official domain list before entering credentials or transferring assets, and to report any interaction with imtokenofficial-china.com to their security teams immediately.