imtokendex[.]net

This domain is flagged as a high-risk brand impersonation threat targeting OKX, a major cryptocurrency exchange platform. The site employs deceptive tactics to mimic legitimate exchange services, likely aiming to harvest user credentials or facilitate unauthorized transactions. Analysis indicates a deliberate attempt to exploit trust in the OKX brand, posing significant risks to unsuspecting users. Infrastructure analysis reveals the domain imtokendex.net was registered on February 21, 2026, through Gname.com Pte. Ltd. It resolves to the IP address 172.67.187.19 and is currently offline. The domain appears on four security blocklists and is flagged by 10 out of 95 security vendors on VirusTotal. Additional technical indicators include a Gridinsoft trust score of 0/100 and detection by Google Safe Browsing for social engineering. Detected technologies include Vue.js, Cloudflare Browser Insights, and HTTP/3, suggesting a modern, obfuscated infrastructure designed to evade detection. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP address across all network security controls. Organizations should update endpoint protection rules to flag any attempts to access imtokendex.net or related infrastructure. Users who may have interacted with the domain should reset credentials for any cryptocurrency exchange accounts, enable multi-factor authentication, and monitor for unauthorized transactions. Security teams are advised to review logs for connections to 172.67.187.19 and correlate with other known indicators of compromise associated with OKX impersonation campaigns.