tokewn[.]im

This domain is flagged as a high-risk brand impersonation threat specifically targeting OKX, a major cryptocurrency exchange platform. The infrastructure is designed to deceive users into believing they are interacting with legitimate OKX services, likely through fake login portals, fraudulent token sales, or malicious wallet interfaces. Such impersonation schemes are commonly used to harvest sensitive credentials, private keys, or financial information, leading to unauthorized account access and asset theft. The domain’s design and content are engineered to exploit trust in the OKX brand, increasing the likelihood of successful social engineering attacks against unsuspecting users. Analysis indicates that tokewn.im was registered on February 21, 2026, through an undisclosed registrar, and resolves to the IP address 54.199.225.116, hosted on infrastructure belonging to a major cloud provider in Japan. The domain is currently flagged by 13 out of 95 security vendors on VirusTotal, and appears on four independent security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. The SSL certificate is issued under the name PhishDestroy / botadmin.destroy.tools, a known indicator of malicious infrastructure. The domain’s creation date, combined with its rapid inclusion on multiple blocklists, suggests a coordinated and deliberate effort to exploit the OKX brand for fraudulent purposes. Users who have visited tokewn.im or interacted with its content should immediately cease all engagement and take corrective actions. Any credentials, private keys, or sensitive information entered on the site should be considered compromised and revoked. Affected individuals should review their OKX accounts for unauthorized transactions, enable multi-factor authentication, and monitor for signs of identity theft or financial fraud. Additionally, security teams should update blocklists to include this domain and its associated IP address, while users should verify the authenticity of any communication claiming to originate from OKX through official channels only.