imtoken-trade[.]com

The domain imtoken-trade.com has been identified as a brand impersonation threat specifically targeting OKX, a prominent cryptocurrency exchange platform. This domain was designed to mimic legitimate OKX services, likely to deceive users into disclosing sensitive credentials or transferring digital assets under false pretenses. As of the latest assessment, the domain has been taken offline, though prior activity and infrastructure analysis confirm its malicious intent. Analysis of technical indicators reveals significant red flags. The domain was flagged by 22 of 95 security vendors on VirusTotal, indicating broad consensus regarding its malicious nature. It was registered through Dominet (HK) Limited on October 16, 2025, and resolved to the IP address 107.151.68.84, hosted within AS132839 (POWER LINE DATACENTER) in Hong Kong. The domain appears on one security blocklist, and its SSL certificate was issued by Let's Encrypt (R12), a common tactic among threat actors to lend superficial legitimacy. The page title, '404 Not Found,' suggests either a temporary takedown or a deliberate attempt to evade detection while maintaining infrastructure readiness. The current offline status of imtoken-trade.com does not eliminate the associated risks, as threat actors frequently reactivate domains or repurpose infrastructure for subsequent campaigns. Organizations and users are advised to block the domain and its associated IP address at the network level to prevent potential access. Security teams should monitor for related domains registered through the same registrar or hosted on the same IP range, as these may indicate follow-up attacks. Users who may have interacted with the domain should immediately revoke any active sessions, reset credentials, and review transaction histories for unauthorized activity. Proactive threat hunting based on the provided indicators of compromise (IoCs) is recommended to identify and mitigate residual exposure.