mtoken[.]one

mtoken.one was registered on March 31, 2026 and is presently active, returning HTTP 200 responses. The site presents the page title “imToken | Ethereum”, a clear mismatch to the advertised target brand OKX, indicating a deliberate brand‑impersonation attempt. The domain is classified as high‑risk by internal scoring and carries the unique seed identifier 3d09b1. The hosting resolves to 188.114.97.3, an address owned by Cloudflare, Inc. and geolocated to Canada. DNS resolution uses the Cloudflare authoritative nameservers dana.ns.cloudflare.com and lynn.ns.cloudflare.com, and the site is protected by a Let’s Encrypt certificate (issuer E7). Traffic is served over HTTP/3 and includes client‑side libraries such as Ant Design, scrollreveal, Help Scout, Google Analytics, Baidu Analytics, and Cloudflare Browser Insights, all of which are typical of commodity phishing kits. Reputation services assign a Gridinsoft trust score of 0 out of 100, and VirusTotal reports that 16 of 95 security vendors flag the domain as malicious. The domain appears on one external blocklist and is already listed by PhishDestroy, confirming that multiple threat‑intelligence feeds have observed malicious activity. The content is crafted to mimic OKX login flows, leveraging the legitimate‑looking “imToken | Ethereum” title to lure users familiar with cryptocurrency wallets. Defenders should block mtoken.one at the DNS and proxy layers, enforce TLS inspection to capture the underlying HTTP payload, and monitor for outbound connections to 188.114.97.3. Endpoint security tools should be updated with the observed Indicators of Compromise, including the domain, IP address, and the specific JavaScript libraries identified. User awareness campaigns that highlight the discrepancy between the page title and the expected OKX branding can reduce credential‑theft success rates.