imtokenofficial-zh[.]com

This domain, imtokenofficial-zh.com, is flagged as a brand impersonation threat targeting OKX, a cryptocurrency exchange and wallet provider. Analysis indicates the infrastructure was designed to mimic legitimate wallet services, likely to harvest user credentials or private keys through deceptive login portals. While the page currently returns a 404 Not Found status, the domain's registration and technical configuration align with known phishing patterns observed in cryptocurrency-related fraud campaigns. Infrastructure analysis reveals the following technical indicators: the domain was registered through Dominet (HK) Limited on April 15, 2026, and resolves to the IP address 160.124.192.211. It employs a Let's Encrypt SSL certificate, Nginx web server, and HTTP Strict Transport Security (HSTS) headers, which are often leveraged to lend an appearance of legitimacy. VirusTotal reports 4 out of 95 security vendors flagging this domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and was previously blocked by network-level protections. As of the latest assessment, imtokenofficial-zh.com has been taken offline, reducing immediate exposure risk. However, the domain remains registered and could be reactivated or repurposed for future malicious activity. Users who may have interacted with this domain prior to its takedown are advised to revoke any associated wallet permissions, reset credentials, and monitor accounts for unauthorized transactions. Organizations should maintain blocklist updates and monitor for similar impersonation domains leveraging variations of the OKX or imToken brand names.