imtokenas[.]com

imtokenas.com was observed resolving to the Cloudflare‑owned address 172.67.180.250, which is announced by AS13335 and geolocated to the United States. The domain was registered on 13 April 2025 through Gname.com Pte. Ltd. and is served by the Cloudflare authoritative nameservers burt.ns.cloudflare.com and kami.ns.cloudflare.com. The site presents the page title “imToken 官网｜以太坊和比特币区块链钱包 – imtokenas.com”, indicating a focus on the imToken wallet, while the threat intelligence tags it as a Crypto Scam that impersonates the Compound platform. The SSL certificate is issued by Google Trust Services under the WE1 hierarchy, and the connection employs HSTS, HTTP/3 and Cloudflare Browser Insights, confirming the use of Cloudflare’s security stack.

Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence in malicious intent. VirusTotal reports that 16 of 95 scanned security vendors flag the domain, and the domain appears on a single external blocklist; PhishDestroy has already taken the domain offline. The risk level is classified as elevated and the current operational status is offline, indicating that the infrastructure has been taken down or otherwise rendered inaccessible.

Evidence does not disclose the exact content or credential‑stealing mechanisms beyond the page title, leaving the specific phishing vector uncertain. Defenders should continue to block the IP address 172.67.180.250 and the domain name, update intrusion detection signatures with the observed resolver and SSL fingerprint, and monitor for any re‑registration attempts that reuse the same registrar or nameserver pattern. Additional analysis of any archived snapshots would be required to confirm the exact impersonation tactics used against Compound users.