imtoken-wallet-guide[.]com

This domain, imtoken-wallet-guide.com, poses a significant threat of brand impersonation, specifically targeting the well-known cryptocurrency exchange OKX. The domain appears to mimic the official imToken wallet, a popular tool for managing cryptocurrencies, but is designed to deceive users into providing sensitive information such as login credentials or private keys.

Analysis indicates that imtoken-wallet-guide.com has been flagged by 18 out of 95 security vendors on VirusTotal, a platform used to detect malicious URLs and files. The domain was registered through Dynadot Inc on March 21, 2026, and has been blocked by three security services: MetaMask, PhishDestroy, and SEAL. The SSL certificate is issued by Let's Encrypt, a common practice among phishing sites to appear more legitimate. Infrastructure analysis reveals that the domain resolves to the IP address 38.173.253.148 and uses technologies such as Nginx, HSTS, and HTTP/3. The page title, 'imToken·(中国官方) - 全球领先的加密货币管理钱包', further suggests an attempt to impersonate the official imToken wallet, which is particularly concerning for users of OKX and imToken.

If users have visited imtoken-wallet-guide.com, they should immediately check their accounts for any unauthorized activity. It is recommended to change passwords and enable two-factor authentication (2FA) on all related accounts. Users should also monitor their financial statements and report any suspicious transactions to their respective financial institutions. Additionally, users are advised to avoid clicking on links or downloading files from untrusted sources and to verify the authenticity of websites by cross-referencing URLs and domain registration information.