imtokenflp[.]com

This domain, imtokenflp.com, is flagged as an active brand impersonation threat targeting OKX, a major cryptocurrency exchange and wallet provider. Analysis indicates the site mimics legitimate OKX wallet services, likely to harvest credentials or deploy crypto drainer malware. The domain does not currently host overt drainer kit artifacts but presents a placeholder page titled '网站筹建中' (Site Under Construction), a common tactic to evade initial scrutiny while preparing malicious payloads. No direct wallet interaction prompts are visible, but the infrastructure aligns with known phishing campaigns targeting crypto users through fake wallet interfaces or recovery portals. Infrastructure analysis reveals the following technical indicators: the domain was registered on September 07, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with phishing domains. It resolves to IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335), which is often leveraged to obscure origin servers and evade takedowns. The SSL certificate is issued by Let’s Encrypt (R13), a legitimate provider commonly abused in phishing operations. VirusTotal detection shows 20 out of 95 security vendors flagging the domain as malicious, while it appears on two blocklists: PhishDestroy and PhishingDB. Google Safe Browsing status is not explicitly provided but is likely marked as unsafe given the blocklist presence and VT score. Current status indicates the domain remains active, with no evidence of suspension or sinkholing. The placeholder page suggests the campaign may be in a preparatory phase, awaiting deployment of final malicious content. Response actions should include immediate blacklisting of the domain and IP across security gateways, as well as monitoring for related subdomains or typosquatting variants. Users are advised to verify wallet addresses via official OKX channels and avoid interacting with any unsolicited links or recovery prompts. The remaining risk is classified as high due to the domain’s active status, Cloudflare hosting, and established impersonation tactics targeting cryptocurrency assets.