imtokentrade[.]com

This domain, imtokentrade.com, operates as a credential theft platform specifically designed to impersonate OKX, a major cryptocurrency exchange. The site targets users by mimicking legitimate OKX login portals, tricking victims into entering sensitive account credentials, private keys, or two-factor authentication codes. Infrastructure analysis reveals the domain is engineered to harvest and exfiltrate stolen data to attacker-controlled servers, enabling unauthorized access to cryptocurrency wallets and exchange accounts. The threat extends beyond financial loss, as compromised credentials may facilitate secondary attacks, including identity fraud or further phishing campaigns against contacts of the victim. Evidence supporting the malicious classification includes multiple technical indicators. The domain is flagged by 5 out of 95 security vendors on VirusTotal, with detections labeling it as phishing or fraudulent. Registered through Gname.com Pte. Ltd. on April 06, 2026, the domain exhibits an anomalous creation date, suggesting potential typosquatting or preemptive registration for malicious use. It resolves to the IP address 188.114.97.3 and appears on three distinct security blocklists, including MetaMask and SEAL, which specifically block cryptocurrency-related threats. Additionally, the domain was identified in one threat intelligence pulse on AlienVault OTX, further corroborating its association with malicious activity. Users who visited imtokentrade.com or entered credentials on the site should assume their information has been compromised. Immediate actions include revoking access to any linked cryptocurrency wallets or exchange accounts, rotating passwords, and enabling multi-factor authentication on all financial platforms. Monitor accounts for unauthorized transactions and report any suspicious activity to the legitimate service provider. If private keys or recovery phrases were exposed, transfer assets to a new, secure wallet immediately. Security teams should update blocklists to include this domain and its associated IP address to prevent further access within organizational networks.