zg-imtokenweb[.]com

PhishDestroy identifies zg-imtokenweb.com as an active cryptocurrency scam designed to trick OKX users into revealing their wallet credentials and private keys. The domain mimics the official ‘imToken’ integration page for OKX Web3, a popular mobile wallet service, but instead redirects victims to a fraudulent login portal. Once credentials are entered, attackers immediately drain victim wallets. This site was registered just days ago on March 22, 2026, yet remains dangerously undetected with 0 detections out of 95 scans on VirusTotal—a clear red flag for new, malicious domains. This domain was flagged by PhishDestroy using behavioral analysis and WHOIS intelligence. It resolves to IP 191.214.176.204 and uses a legitimate Let’s Encrypt SSL certificate to appear trustworthy. It was registered through TuringSign Inc. (d/b/a Cosmotown), a domain seller known for privacy protection and bulk registrations, which is often exploited by threat actors to hide ownership. The combination of zero detections, recent creation, and false branding targeting a major exchange like OKX makes this a high-risk threat under active investigation. If you visited zg-imtokenweb.com or entered any credentials, disconnect your device from the internet immediately and revoke any connected wallet permissions through your wallet app or OKX dashboard. Change all account passwords and enable two-factor authentication where available. Report the domain to your antivirus provider and to OKX support. Never trust unsolicited links—always verify URLs by typing them manually. Stay alert: this scam is still live and evolving.