imtokeun[.]im

The domain imtokeun.im is assessed with an elevated risk level and is identified as a brand impersonation threat, specifically targeting the cryptocurrency exchange OKX. This assessment is based on multiple technical indicators and security vendor analyses.

Analysis indicates that imtokeun.im is flagged by 15 out of 95 security vendors on VirusTotal, signaling a moderate level of consensus on its malicious nature. The domain is registered through a redacted registrar, which may indicate an attempt to obfuscate ownership. It resolves to the IP address 2606:4700:3033::ac43:cae5, which is located in the United States and is part of AS13335 Cloudflare, Inc. The domain was created on February 21, 2026, which is a relatively recent date and can be a sign of a new threat campaign. Additionally, imtokeun.im appears on two security blocklists, including PhishDestroy and PhishingDB, further validating its malicious status. The site's SSL certificate is issued by Google Trust Services / WE1, which might initially lend a false sense of security to unsuspecting users.

To mitigate the risks associated with this brand impersonation threat, users are advised to verify the authenticity of the URLs they visit, especially those related to OKX. Security teams should block the IP address 2606:4700:3033::ac43:cae5 and the domain imtokeun.im in their network firewalls and DNS filters. Regularly updating security software and educating users about the signs of phishing and brand impersonation can also help prevent unauthorized access and potential financial loss.