m[.]imdowna[.]icu

The domain m.imdowna.icu was registered on February 21, 2026 and is currently reported as offline. DNS resolution points to the IP address 203.160.53.167, which belongs to Cloudie Limited in Hong Kong and is announced by ASN 55933. The site presented a page title in Chinese reading "im钱包下载-imToken钱包-imToken安装下载地址," indicating an apparent attempt to lure victims into downloading a cryptocurrency wallet application. The SSL certificate is identified as type R12, but no further certificate details are available.

Reputation services assign extremely low trust scores: Scamadviser rates the domain 1 out of 100 and Gridinsoft rates it 0 out of 100, reflecting a high likelihood of malicious intent. The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy feed. VirusTotal analysis shows that 12 of 93 scanning engines flagged the domain, reinforcing the suspicion of phishing activity.

No additional intelligence such as Safe Browsing, OTX, or registrar details is provided. Given the combination of a newly created domain, low trust scores, a targeted page title, and multiple vendor detections, defenders should treat m.imdowna.icu as a high‑confidence phishing indicator. Recommended actions include adding the domain and its resolving IP to network deny lists, monitoring for any re‑activation attempts, and ensuring endpoint security solutions are updated to block the observed malicious payloads associated with the imToken wallet theme.