imtokan[.]co

This domain, imtokan.co, poses a direct threat as a brand impersonation site targeting Ethereum cryptocurrency users. Analysis indicates it mimics the official imToken wallet platform, a widely used Ethereum and Bitcoin blockchain wallet, to deceive visitors into disclosing sensitive credentials or transferring digital assets to attacker-controlled addresses. The fraudulent site uses a nearly identical page title, 'imToken official website｜Ethereum and Bitcoin blockchain wallet,' to exploit brand recognition and user trust in the legitimate service. Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain was registered on February 21, 2026, through NETIM SAS, and currently resolves to the IP address 20.247.100.105, hosted on Microsoft Corporation’s AS8075 in Hong Kong. Security vendors have flagged the domain on VirusTotal, with 21 out of 95 engines detecting it as malicious. Additionally, it appears on one security blocklist and is actively blocked by PhishDestroy. The site uses a Let’s Encrypt SSL certificate (R12), which, while providing encryption, does not validate legitimacy and is commonly abused in phishing operations. Users who visited imtokan.co should take immediate action to mitigate potential compromise. Disconnect any connected wallets from the site and revoke any active session permissions using a legitimate wallet interface. Scan local devices for malware using updated security tools, as interaction with phishing sites may expose users to secondary payloads. Monitor cryptocurrency transactions for unauthorized activity and consider transferring assets to a new wallet if credentials were entered. Report the domain to relevant abuse channels and cryptocurrency security platforms to support broader threat containment efforts.