lianshui[.]pilot45[.]com

Analysis of the domain lianshui.pilot45.com indicates it was actively impersonating imToken, a cryptocurrency wallet service, as of its detection on July 23, 2026. The domain was registered on December 23, 2024, through Gname.com Pte. Ltd., and hosted on Cloudflare infrastructure (AS13335) with an IP resolution of 172.67.128.224, located in the US. Nameservers aron.ns.cloudflare.com and titan.ns.cloudflare.com were in use, consistent with Cloudflare's DNS services. The page title, 'im官网-imtoken安卓版冷钱包下载,' explicitly references imToken's official site and promotes a purported Android cold wallet download, confirming the brand impersonation intent.

No SSL certificate was detected, increasing the likelihood of insecure data transmission. The domain was flagged by 14 of 95 security vendors on VirusTotal and appears on at least one security blocklist, including PhishDestroy, which took action to block it. As of the report date, the domain is offline, though its prior operational status and infrastructure remain relevant for historical threat analysis. Defenders should treat this domain as a confirmed brand impersonation vector targeting imToken users.

The absence of SSL, Cloudflare hosting, and the specific page title provide actionable indicators for network-level blocking and retrospective log analysis. While the domain is no longer active, its registration details and hosting provider may assist in identifying related threat clusters. Further investigation into the registrar's abuse handling and Cloudflare's historical DNS records could yield additional compromised subdomains or infrastructure reuse patterns.