biblesignals[.]com

This domain, biblesignals.com, is identified as an active phishing site specifically targeting cryptocurrency users by impersonating imToken, a widely used digital wallet platform. The site presents itself as an official source for imToken software downloads, a tactic commonly employed to distribute malicious payloads or harvest credentials from unsuspecting victims. Analysis confirms the domain is currently operational and serving content designed to deceive users into engaging with fraudulent resources. Infrastructure analysis reveals multiple high-risk indicators. The domain is flagged by 13 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It was registered through NAMECHEAP INC on December 24, 2020, and resolves to the IP address 176.65.139.8, hosted by AS214472 Offshore LC in the Netherlands. The domain appears on at least one security blocklist and is blocked by enterprise-grade threat intelligence platforms. The SSL certificate is issued by Let's Encrypt (YR1), a common choice for both legitimate and malicious sites, which does not mitigate the underlying risk. The page title explicitly references imToken’s official download portal, reinforcing the impersonation theme. Current status remains active, with no evidence of takedown or remediation. Users and organizations are strongly advised to block this domain at the network level and update endpoint protection rules to prevent access. Cryptocurrency holders should verify all software downloads exclusively through imToken’s official website or verified app stores. Network administrators are recommended to monitor for connections to 176.65.139.8 and the associated AS214472, as these may indicate compromised systems or ongoing phishing attempts. Immediate reporting to domain registrars and hosting providers is encouraged to facilitate disruption of this fraudulent infrastructure.