imtoken-ch[.]org[.]cn

PhishDestroy has identified imtoken-ch.org.cn as a high-risk domain actively impersonating OKX, a leading cryptocurrency exchange, to distribute a Web3 wallet drainer. This fraudulent site lures victims with promises of secure asset management while deploying malicious scripts to siphon crypto funds from connected wallets. Once accessed, the domain poses an immediate threat to users' digital assets, particularly those interacting with decentralized applications or storing cryptocurrency in web-based wallets. This domain exhibits multiple red flags consistent with malicious activity. According to VirusTotal, only 1 out of 95 security vendors flagged this domain, highlighting the stealthy nature of the threat. The domain is registered through 成都西维数码科技有限公司 and was created on January 28, 2026, making it a very recent addition to the threat landscape. Despite its brief existence, the domain remains active and continues to operate, posing an ongoing risk to unsuspecting users. The use of a Let's Encrypt SSL certificate adds a veneer of legitimacy, further deceiving potential victims. If you have visited imtoken-ch.org.cn, cease all interactions with the site immediately and disconnect any connected cryptocurrency wallets. Inspect your wallet transactions for unauthorized transfers and revoke any suspicious smart contract approvals. To verify the safety of a domain, use PhishDestroy's real-time threat intelligence tools. Always cross-check URLs against official brand domains and rely on verified communication channels when downloading cryptocurrency-related software. Staying vigilant and using reputable security tools are critical steps to avoid falling victim to such crypto drainer scams.