imtaken[.]cc

The domain imtaken.cc was registered on 21 February 2026 and is presently hosted on the IP address 20.247.100.105, which resolves to a Microsoft Corporation network (AS8075) located in Hong Kong. The site’s TLS certificate is identified as R13, indicating a publicly trusted certificate without obvious anomalies. The page title returned from the HTTP response reads "imToken official website｜Ethereum and Bitcoin blockchain wallet", a clear reference to the imToken cryptocurrency wallet service, while the threat intelligence tags list the brand target as Arbitrum. This mismatch between the page title and the claimed impersonated brand suggests a deliberate brand‑impersonation tactic aimed at users of the Arbitrum ecosystem.

Open‑source threat feeds corroborate the malicious nature of the domain. AlienVault OTX includes the domain in one pulse, and VirusTotal reports that 20 of 93 security vendors classify the host as malicious, a proportion that exceeds typical background noise for benign sites. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, reinforcing the assessment that it is being used for a crypto‑related scam. The current HTTP status is reported as offline, meaning the site is not presently serving content, which limits real‑time verification of the exact payload but does not negate the historical evidence of abuse.

Defenders should continue to block imtaken.cc at the DNS and proxy layers, and add the associated IP range to network‑level deny lists. Because the infrastructure resides on a Microsoft‑owned AS, contacting the provider’s abuse team with the full set of indicators (domain name, IP address, registration date, detection counts, and blocklist references) may expedite takedown. Continuous monitoring of passive DNS and certificate transparency logs is advised to detect any re‑registration or reuse of the same IP address by related threats.