imt0ken[.]cc

The domain imt0ken.cc was registered on 10 October 2025 through Gname.com Pte. Ltd. and is currently configured to use the Cloudflare authoritative name servers collins.ns.cloudflare.com and lee.ns.cloudflare.com. DNS resolution points to the address 104.21.23.170, an IP that is part of Cloudflare’s edge network and therefore does not reveal a dedicated backend host. The domain appears on a single external blocklist and is actively blocked by the PhishDestroy service, indicating that at least one security‑focused organization has observed malicious use. VirusTotal analysis shows that 14 of 91 scanned security vendors flag the domain, confirming a consensus of malicious classification across multiple engines.

The threat type is listed as generic phishing and the risk level is high. The domain’s status is marked as active, meaning the malicious infrastructure is still reachable. No public page title, SSL certificate details, HTTP response codes, or Safe Browsing verdicts are available in the current intelligence set, so the exact content served by the site remains unknown. Likewise, no attribution to a specific phishing kit, brand impersonation, or secondary infrastructure has been disclosed.

Given the concrete indicators—registrar information, Cloudflare name servers, IP address, blocklist inclusion, and multi‑vendor detection—defenders should treat imt0ken.cc as a high‑confidence phishing indicator. Recommended mitigation steps include adding the domain to DNS‑based blocklists, configuring firewall rules to drop outbound connections to 104.21.23.170, and monitoring for any future resolution changes. Continuous re‑evaluation is advised, as the absence of detailed page analysis leaves open the possibility of additional payloads or credential‑stealing pages being hosted behind the same domain.