imtoken[.]rip

PhishDestroy identifies imtoken.rip as an active crypto drainer impersonating the OKX brand. This domain is currently operational and poses an elevated risk to cryptocurrency users who may be deceived by its fraudulent branding. The threat involves malicious actors leveraging the trust associated with OKX to trick victims into connecting wallets or entering sensitive credentials, resulting in asset theft.

This domain was flagged by 18 of 95 VirusTotal security vendors, indicating significant malicious activity. It resolves to IP address 154.215.102.109 and is registered through Dynadot Inc. The domain was created on March 01, 2026, and operates with a valid SSL certificate issued by Let’s Encrypt, further enhancing its deceptive appearance. These indicators collectively highlight the domain’s malicious intent and its potential to evade basic security checks.

Given the active status of imtoken.rip and its association with a well-known cryptocurrency platform, users are strongly advised to exercise caution. PhishDestroy recommends avoiding interactions with this domain and verifying any suspicious links or communications through trusted channels. Users should report such domains to PhishDestroy and their respective security teams to aid in takedown efforts and protect the broader community from fraudulent activities. Always cross-check URLs and use official platforms for cryptocurrency transactions.