site-imtokenofficial[.]com

PhishDestroy identifies site-imtokenofficial.com as an active crypto drainer impersonating OKX, a leading global cryptocurrency exchange. This domain employs brand impersonation tactics to trick users into connecting their wallets or entering credentials on fraudulent pages mimicking official OKX services. The threat is elevated due to the domain’s recent registration and the use of a legitimate SSL certificate from Let's Encrypt, which may lull visitors into a false sense of security. While currently undetected on VirusTotal, dynamic threat intelligence suggests this infrastructure is part of a broader campaign targeting crypto users. This domain was flagged through automated monitoring of suspicious registrations and impersonation patterns. Key technical indicators include a registration date of October 08, 2025, through Dominet (HK) Limited, and resolution to IP address 160.124.192.213. Despite zero detections on VirusTotal at the time of analysis, similar domains in this campaign have shown rapid evasion techniques, including rotating IPs and domain generation algorithms. The risk level remains under investigation, but the active status and alignment with known drainer toolkits warrant immediate caution. Users who visited site-imtokenofficial.com should assume exposure and take precautions. Disconnect any connected wallets immediately if you interacted with the site, especially if prompted to sign transactions or enter seed phrases. Clear browser cache and cookies related to the domain, and scan your device with updated antivirus software. Report the domain to PhishDestroy and your organization’s SOC if this appears in a work environment. Always verify URLs against official sources before engaging, and use PhishDestroy’s real-time verification tool to inspect suspicious links preemptively.