imtokan[.]com[.]cn

PhishDestroy identifies imtokan.com.cn as an active cryptocurrency drainer kit masquerading as a legitimate service. This domain was flagged by Google Safe Browsing for delivering MALWARE payloads targeting wallet credentials and digital assets. The infrastructure supports a fraudulent interface designed to trick users into connecting crypto wallets for unauthorized transfers. No established brand affiliation was detected, indicating a freshly deployed campaign leveraging deceptive domain choice and SSL encryption to appear credible.

Technical indicators confirm elevated risk: VirusTotal shows 17/95 detections at time of analysis, meaning current antivirus engines have not yet flagged the payload. The domain was registered through 成都伊索信息科技有限公司 and resolves to IP 216.118.243.92. It was created on March 26, 2026, and currently carries a Google Safe Browsing MALWARE flag. The SSL certificate is issued by Let's Encrypt, which is commonly abused in short-lived phishing campaigns to avoid immediate detection. These factors suggest a rapidly evolving but still low-signature threat.

The domain remains active under investigation with a status of 'active'. Despite zero VirusTotal detections, the presence of a Google Safe Browsing MALWARE flag indicates confirmed malicious activity. No public takedown response has been recorded yet. Remaining risk is high due to the domain's recent creation, low detection coverage, and active deployment of drainer scripts. Users are strongly advised to avoid interaction and report the domain to browser security teams and threat intelligence platforms. Organizations should block the domain and IP at network perimeter to prevent access.