imtoken-android[.]org[.]cn

This domain, imtoken-android.org.cn, poses a specific threat of brand impersonation, targeting the well-known cryptocurrency exchange OKX. The domain mimics the legitimate imToken wallet website, using a similar page title to deceive users into believing they are accessing an official resource. This deception can lead to the theft of sensitive information, such as login credentials and private keys, which are crucial for secure digital asset management.

Analysis indicates that imtoken-android.org.cn has been flagged by 4 out of 95 security vendors on VirusTotal, suggesting a moderate level of detection but highlighting the potential for evasion. The domain was registered through 成都西维数码科技有限公司 on April 30, 2026, and has a Gridinsoft trust score of 0/100, indicating a complete lack of trustworthiness. The domain appears on 3 security blocklists and was taken offline, suggesting that it has been identified and mitigated by security organizations. The SSL certificate is issued by Let's Encrypt, which is often used by phishing sites to appear more legitimate. The domain resolves to the IP address 38.12.166.198 and uses technologies such as Nginx, HSTS, and HTTP/3, which can contribute to the site's operational efficiency and user experience, furthering the illusion of legitimacy.

If users have visited imtoken-android.org.cn, they should immediately check their OKX and imToken wallet accounts for any unauthorized activity. It is recommended to change passwords and enable two-factor authentication (2FA) if not already in place. Users should also monitor their financial transactions and report any suspicious activity to both the affected service providers and local authorities. Additionally, users should avoid clicking on links or downloading files from unverified sources in the future and use official channels for accessing digital asset management services.