web3imtoken[.]com

PhishDestroy identifies the domain web3imtoken.com as an active brand impersonation threat impersonating OKX. Current status is active, with the domain engaging in crypto drainer operations to deceive users into transferring digital assets. The threat remains under investigation as additional indicators are collected and analyzed by threat intelligence teams.

This domain was flagged by 11 of 95 VirusTotal vendors as of the latest scan, indicating a currently undetected threat. Registration was completed through Dominet (HK) Limited, and the domain resolves to the IP address 160.124.196.133. The domain was created on October 08, 2025, which is recent and indicative of opportunistic registration for malicious purposes. The SSL certificate is issued by Let's Encrypt, a common tactic to appear legitimate. No blocklist entries or trust score data are currently available, further emphasizing the need for proactive defense measures.

Given the active status and lack of vendor detection, immediate action is required. Users and organizations are advised to block the domain web3imtoken.com at the network level and update browser-based blocklists to prevent access. Additionally, educate users about the risks of interacting with domains claiming affiliation with OKX, especially those soliciting cryptocurrency transfers. Monitor network traffic for connections to 160.124.196.133 and investigate any related activity. Threat hunting queries should include the domain, IP address, and SSL certificate issuer as indicators of compromise.