imtoken-chinese[.]com

This domain, imtoken-chinese.com, operates as a brand impersonation threat specifically targeting users of the OKX cryptocurrency exchange. Analysis indicates the site was designed to mimic legitimate wallet services, likely to harvest login credentials or distribute malicious payloads under the guise of a trusted platform. The domain exhibits characteristics consistent with crypto-focused social engineering attacks, where users are tricked into entering sensitive information on fraudulent interfaces. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on May 16, 2026, through NameMart Pte. Ltd., and currently resolves to the IP address 154.216.96.172. Security vendors on VirusTotal flagged the domain at a rate of 19/95, while it appears on two independent security blocklists. The site previously returned a 404 Not Found status, though technologies such as Nginx and HSTS were detected during active periods. A Gridinsoft trust score of 0/100 further corroborates its malicious classification. Users who visited imtoken-chinese.com should assume potential exposure to credential theft or malware distribution. Immediate actions include revoking access to any associated OKX or wallet accounts, rotating passwords, and enabling multi-factor authentication where available. Devices used to access the domain should undergo a full security scan to detect any installed malicious software. Monitoring for unauthorized transactions on linked crypto wallets is critical, as stolen credentials may lead to financial loss. If sensitive data was entered, consider reporting the incident to relevant financial or cybersecurity authorities for further mitigation.