# PhishDestroy domain threat record: tokanim-cdn16-hk16.club

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/tokanim-cdn16-hk16.club/
Machine-readable companion: https://phishdestroy.io/domain/tokanim-cdn16-hk16.club/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-22 13:18:02 UTC
- Last availability or vendor check: 2026-10-22 13:18:02 UTC
- Stored record updated: 2026-10-22 16:30:26 UTC
- VirusTotal detections in the stored snapshot: 7/92
- Independent public blocklist matches in the stored snapshot: 1
- Matching public blocklists: OpenPhish
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: imToken

## Stored infrastructure

- Observed IP address: 156.225.27.69
- Registrar in stored WHOIS data: Dynadot Inc
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 200
- Registration date (registry RDAP, tokanim-cdn16-hk16.club): 2026-10-14 17:16:56 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a163c1-ade9-700d-9544-6224e35cd650/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/tokanim-cdn16-hk16.club
- Certificate Transparency search: https://crt.sh/?q=%25.tokanim-cdn16-hk16.club
- Web Archive lookup: https://web.archive.org/web/*/https://tokanim-cdn16-hk16.club/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed the domain on 2026-10-22 after its intake system recorded a Google Safe Browsing social‑engineering flag. The fetched page displayed the title “imToken | Ethereum & Bitcoin Wallet” and returned HTTP 200 on the same day. The domain was first observed by PhishDestroy eight days after registration.

How the scam works
The detections indicate a phishing attempt, where attackers copy the look‑and‑feel of a legitimate crypto‑wallet brand to trick users into entering credentials or authorising wallet connections. Such pages typically present login forms or connection prompts that appear authentic. No concrete malicious behavior was captured on the page beyond the brand impersonation cue.

Evidence
On 2026-10-22 VirusTotal scanned the domain with 92 engines, reporting 5 malicious and 2 suspicious detections from vendors including Emsisoft, Fortinet, Google Safe Browsing, Netcraft and Webroot. Google Safe Browsing also flagged it for social‑engineering on the same date. urlscan.io captured the site on 2026-10-22 and gave it a malicious phishing verdict, linking it to the imToken brand, and Cloudflare Radar returned an identical phishing classification. PhishDestroy’s internal blocklist marks the domain as blocked, while external public blocklists showed no additional hits apart from a single Cloudflare Family block.

Infrastructure
The domain was registered with Dynadot Inc on 2026-10-14. DNS resolution on 2026-10-22 returned an A record pointing to 156.225.27.69, owned by Vapeline Technology in Hong Kong, and a CNAME to sjxmc9bu.ikunzf.online; DNSSEC was not enabled. The site presented a Let’s Encrypt TLS certificate valid from 2026-10-14 to 2027-01-12. Open ports observed during the scan were 22, 80 and 443.

What to do
Visitors should not enter any wallet credentials or approve connections on this site; if they have, they should change those credentials and review any associated accounts. Organizations should block the exact domain at firewalls or proxy filters, monitor network logs for connections to the recorded IP or hostname, and incorporate the VirusTotal, Google Safe Browsing and urlscan findings into their threat‑intel feeds.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a163c1-ade9-700d-9544-6224e35cd650/
Cloudflare Radar report: https://radar.cloudflare.com/scan/b6a3ae2d-ac8c-401b-91db-afc62f21d289
Stored capture screenshot: https://i.ibb.co/1tpttrM9/c0ba07de1c79.png
Cloudflare Radar screenshot (2026-10-22T13:48:57Z): https://screenshots.phishdestroy.io/cf/b6a3ae2d-ac8c-401b-91db-afc62f21d289.png
URLScan screenshot (2026-10-22T13:01:21Z): https://screenshots.phishdestroy.io/us/01a163b3-85da-756d-b5d8-b302d3af0b71.png
URLScan capture report: https://urlscan.io/result/01a163b3-85da-756d-b5d8-b302d3af0b71/
VirusTotal report: https://www.virustotal.com/gui/domain/tokanim-cdn16-hk16.club
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=tokanim-cdn16-hk16.club
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-22 13:54:56 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/1tpttrM9/c0ba07de1c79.png
  Captured: 2026-10-22 13:18:02 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a163c1-ade9-700d-9544-6224e35cd650.png
  Captured: 2026-10-22 13:18:02 UTC
  Source report: https://urlscan.io/result/01a163c1-ade9-700d-9544-6224e35cd650/
- URLScan capture 2: https://urlscan.io/screenshots/01a163b3-85da-756d-b5d8-b302d3af0b71.png
  Captured: 2026-10-22 13:09:39 UTC
  Source report: https://urlscan.io/result/01a163c1-ade9-700d-9544-6224e35cd650/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b6a3ae2d-ac8c-401b-91db-afc62f21d289.png
  Captured: 2026-10-22 13:48:57 UTC
  Source report: https://radar.cloudflare.com/scan/b6a3ae2d-ac8c-401b-91db-afc62f21d289
  SHA-256: 1be49605c9b85e2bb053846e91e7e6101ec06c2edba3724393061d80ae3e1f11
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a163b3-85da-756d-b5d8-b302d3af0b71.png
  Captured: 2026-10-22 13:01:21 UTC
  Source report: https://urlscan.io/result/01a163b3-85da-756d-b5d8-b302d3af0b71/
  SHA-256: f297e9689471b9352168a2d24b894f6d12c72455f5e0e602ef0fd913b5de4817

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-22T13:54:14Z",
        "uuid": "01a163c1-ade9-700d-9544-6224e35cd650",
        "scanned_at": "2026-10-22T13:16:48Z",
        "final_url": "https://tokanim-cdn16-hk16.club/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://tokanim-cdn16-hk16.club/",
                "from": "http://tokanim-cdn16-hk16.club/",
                "status": 307
            }
        ],
        "ip": "156.225.27.69",
        "ips": [
            "156.225.27.69"
        ],
        "asns": [
            "401701"
        ],
        "countries": [
            "SC"
        ],
        "link_domains": [
            "shop42404838.m.youzan.com",
            "www.ethereum.org",
            "polkadot.network",
            "cosmos.network",
            "entethalliance.org",
            "new.consensys.net",
            "etherscan.io",
            "walletconnect.com",
            "zksync.io",
            "slowmist.com",
            "imtoken.fans"
        ],
        "doc_hash": "59986b9696c6fb5a407ab64773a27fb9ddd8ee040be7e9929a9bf8d9cb88044a",
        "cookies": [
            "PHPSESSID",
            "server_session_c098fd19"
        ],
        "tls": {
            "san": [
                "tokanim-cdn16-hk16.club"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "tokanim-cdn16-hk16.club",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-12T16:33:27Z",
            "valid_from": "2026-10-14T16:33:28Z"
        },
        "domain_age_days": 6,
        "apex_age_days": 6,
        "tls_age_days": 7,
        "tls_valid_days": 89,
        "requests": 28,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "imtoken"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "imToken"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html; charset=UTF-8",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-22T13:54:17Z",
        "uuid": "b6a3ae2d-ac8c-401b-91db-afc62f21d289",
        "scanned_at": "2026-10-22T13:48:57Z",
        "final_url": "https://tokanim-cdn16-hk16.club/",
        "status": 200,
        "history": [
            {
                "url": "https://tokanim-cdn16-hk16.club/",
                "status": 200
            }
        ],
        "dom_hash": "2b778d95bd046bd7819602551d209710e43b3179b1f709d616ae9d792bf2a02f",
        "doc_hash": "59986b9696c6fb5a407ab64773a27fb9ddd8ee040be7e9929a9bf8d9cb88044a",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "Newly Seen Domains",
            "Security Risks",
            "New Domains",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "tokanim-cdn16-hk16.club",
                "type": "CNAME",
                "value": "sjxmc9bu.ikunzf.online"
            },
            {
                "name": "tokanim-cdn16-hk16.club",
                "type": "CNAME",
                "value": "sjxmc9bu.ikunzf.online"
            }
        ],
        "dnssec_valid": false,
        "ip": "156.225.27.69",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-10-14T17:16:56Z",
            "updated": "2026-10-19T17:16:59Z",
            "expires": "2027-10-14T17:16:56Z",
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T13:48:31Z",
        "analysis_at": "2026-10-22T08:06:21Z",
        "stats": {
            "timeout": 0,
            "harmless": 51,
            "malicious": 5,
            "suspicious": 2,
            "undetected": 34
        },
        "detections": {
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "suspicious",
            "Google Safe Browsing": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Suspicious (alphaMountain.ai)"
        },
        "registrar": "Dynadot Inc",
        "created": "2026-10-14T17:16:56Z",
        "expires": "2027-10-14T17:16:56Z",
        "updated": "2026-10-14T17:17:24Z",
        "first_seen": "2026-10-15T02:03:20Z",
        "dns": [
            {
                "ttl": 300,
                "type": "CNAME",
                "value": "sjxmc9bu.ikunzf.online"
            },
            {
                "ttl": 299,
                "type": "CNAME",
                "value": "sjxmc9bu.ikunzf.online"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.tokanim-cdn16-hk16.club",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 1,
                "type": "A",
                "value": "156.225.27.69"
            },
            {
                "ttl": 1,
                "type": "CNAME",
                "value": "z6pnwmjk.ikunzf.online"
            }
        ],
        "dns_at": "2026-10-22T08:07:24Z",
        "jarm": "29d29d00029d29d21c42d42d000000bdfc58c9a46434368cf60aa440385763",
        "cert": {
            "san": [
                "tokanim-cdn16-hk16.club"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "512ad9a57a7de86ec4fb0ccf06df826a0c",
            "sha256": "03f23a8a3de828168d0015c9ca0358d33f348ca91ceeae12833f7734efde80bb",
            "subject": "tokanim-cdn16-hk16.club",
            "valid_to": "2027-01-12T16:33:27Z",
            "valid_from": "2026-10-14T16:33:28Z"
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "registrar_iana_id": "472",
            "registrar_url": "https://www.dynadot.com/",
            "created": "2026-10-14T17:16:56Z",
            "updated": "2026-10-14T17:17:24Z",
            "expires": "2027-10-14T17:16:56Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-14T17:16:56Z",
                "last changed": "2026-10-14T17:29:31Z",
                "registration": "2026-10-14T17:16:56Z",
                "registrar expiration": "2027-10-14T17:16:56Z",
                "last update of RDAP database": "2026-10-21T18:00:30Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T13:54:34Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "tokanim-cdn16-hk16.club"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-22T13:14:36Z",
            "first": "2026-10-15T02:20:58Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.13,
            "avg_page_bytes": 2686
        },
        "social_tags": {
            "title": "imToken | Ethereum & Bitcoin Wallet",
            "keywords": "Bitcoin, Ethereum, BNB Chain, Tron, Polkadot, Polygon, Litecoin, Bitcoin Cash, Cosmos, Optimism, Filecoin, Arbitrum, EOS, Kusama, Tezos, Nervos, Staking, Tokenlon, imKey, Price, Blockchain, Crypto Wallet, DeFi, NFT, cryptocurrency, hardware wallet, cold wallet, Web3",
            "description": "imToken  ，一款安全放心、简单易用的数字钱包，超千万用户信赖. It supports BTC, ETH, BNB, TRX, DOT, MATIC, LTC, BCH, ATOM, OP, FIL, ARB, EOS, KSM, XTZ, CKB and many other tokens. It also allows you to swap token and use DApp right from the wallet"
        },
        "trackers": {
            "requests": 25
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 107,
                "tls": 217,
                "wait": 243,
                "connect": 185,
                "download": 0
            },
            "response_ms": 752
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 9315,
            "co2_grams": 0.0003,
            "cleaner_than": 73
        },
        "cookies": {
            "cookies": [
                {
                    "name": "PHPSESSID",
                    "session": true,
                    "http_only": true
                },
                {
                    "name": "server_session_c098fd19",
                    "http_only": true
                }
            ]
        },
        "location": {
            "ip": "156.225.27.69",
            "asn": "401701",
            "org": "Vapeline Technology",
            "city": "Hong Kong",
            "country": "HK"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR1",
            "subject": "tokanim-cdn16-hk16.club"
        },
        "dns": {
            "A": [
                "156.225.27.69"
            ],
            "CNAME": [
                "sjxmc9bu.ikunzf.online"
            ]
        },
        "dnssec": {
            "ds": true,
            "rrsig": false,
            "dnskey": true
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "156.225.27.69",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://tokanim-cdn16-hk16.club"
            ]
        },
        "tech_stack": {
            "technologies": [
                "PHP",
                "Ant Design",
                "Nginx",
                "HSTS",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "external": [
                "https://shop42404838.m.youzan.com/v2/feature/d5bMdxB3Ab",
                "https://www.ethereum.org/",
                "https://polkadot.network/",
                "https://cosmos.network/",
                "https://entethalliance.org/",
                "https://new.consensys.net/",
                "https://etherscan.io/",
                "https://walletconnect.com/",
                "https://zksync.io/",
                "https://slowmist.com/",
                "https://imtoken.fans/"
            ],
            "external_count": 11,
            "internal_count": 8
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-10-14T17:16:56Z",
            "updated": "2026-10-19T17:16:59Z",
            "expires": "2027-10-14T17:16:56Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp",
                "serverTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns2.dyna-ns.net",
                "ns1.dyna-ns.net"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html; charset=UTF-8",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```