# PhishDestroy domain threat record: tokeimx-cdn22-hk22.sbs

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/tokeimx-cdn22-hk22.sbs/
Machine-readable companion: https://phishdestroy.io/domain/tokeimx-cdn22-hk22.sbs/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 16:15:14 UTC
- Last availability or vendor check: 2026-10-26 16:31:34 UTC
- Stored record updated: 2026-10-26 20:14:44 UTC
- VirusTotal detections in the stored snapshot: 2/92
- Independent public blocklist matches in the stored snapshot: 1
- Matching public blocklists: OpenPhish
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: imToken

## Stored infrastructure

- Observed IP address: 149.88.95.146
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a1790b-5806-747f-a391-c7690d2810d2/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/tokeimx-cdn22-hk22.sbs
- Certificate Transparency search: https://crt.sh/?q=%25.tokeimx-cdn22-hk22.sbs
- Web Archive lookup: https://web.archive.org/web/*/https://tokeimx-cdn22-hk22.sbs/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
As observed on 2026-10-26, the captured screenshot shows a Chinese-language landing page branded imToken, with a blue download button, wallet app mockups and trust statistics of 8 years, 15 million users and 150 plus countries. PhishDestroy listed the page because its logo, copy and wallet imagery mimic the imToken brand. It was first seen by PhishDestroy on 2026-10-26.

How the scam works
The page offers an immediate wallet download under the imToken name, steering visitors to install software from an unaffiliated domain. Because the promotional copy mimics a trusted wallet brand, a visitor may treat the download as official and expose a recovery phrase or password. This is a category risk of impersonation download phishing targeting cryptocurrency wallet users.

Evidence
The screenshot shows the imToken logo, Chinese promotional copy, a download call-to-action button and wallet balance mockups. URLScan judged it malicious with an ML score of 100 in the phishing category on 2026-10-26, recorded a 307 redirect from HTTP to HTTPS ending at the captured page, and logged 28 requests. VirusTotal flagged the domain as malicious, with OpenPhish labelling it phishing and SOCRadar suspicious, while Google Safe Browsing did not flag it. Spamhaus listed it under phishing, OpenPhish appeared on external blocklists alongside PhishDestroy's internal list, and OTX recorded 0 pulses on 2026-10-26; the page returned HTTP 200 with 26 tracker requests.

Infrastructure
The domain was registered on 2026-10-24 through Dynadot Inc, two days before first observation, with recorded hosting network cognetcloud INC. Notable weaknesses: no Content-Security-Policy, no X-Frame-Options, no X-Content-Type-Options, no Referrer-Policy, no Permissions-Policy, no COOP, COEP or CORP; DNSSEC unsigned; no email authentication recorded. HSTS present with max-age 31536000 but without subdomain coverage; CAA present; TLS 1.3, AES-256-GCM, forward secrecy, ALPN h2.

What to do
A visitor who entered a recovery phrase or password on tokeimx-cdn22-hk22.sbs should treat it as compromised, transfer assets to a wallet created from an official source, and change any reused password on the genuine service and enable 2FA. Do not enter secrets into this page again. Security teams should block tokeimx-cdn22-hk22.sbs at the proxy, DNS and endpoint layers and hunt for similar recent registrations.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1790b-5806-747f-a391-c7690d2810d2/
Cloudflare Radar report: https://radar.cloudflare.com/scan/217afe6f-f22b-40b1-8500-63b9bea2034f
URLQuery report: https://urlquery.net/report/2106f5e1-763f-422c-9ba9-57bf9df6ae60
Stored capture screenshot: https://i.ibb.co/5hyJwgf7/57afdc7ea6c1.png
Cloudflare Radar screenshot (2026-10-26T16:19:38Z): https://screenshots.phishdestroy.io/cf/217afe6f-f22b-40b1-8500-63b9bea2034f.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/2106f5e1-763f-422c-9ba9-57bf9df6ae60.png
URLScan screenshot (2026-10-26T07:05:34Z): https://screenshots.phishdestroy.io/us/01a17706-e17d-75bc-b39a-bc76ecf64b38.png
URLScan capture report: https://urlscan.io/result/01a17706-e17d-75bc-b39a-bc76ecf64b38/
URLScan screenshot (2026-10-26T13:01:01Z): https://screenshots.phishdestroy.io/us/01a1784c-a9de-731b-bd38-d896bea8a719.png
URLScan capture report: https://urlscan.io/result/01a1784c-a9de-731b-bd38-d896bea8a719/
URLScan screenshot (2026-10-26T16:21:39Z): https://screenshots.phishdestroy.io/us/01a17901-d500-71c0-9cc1-640420d40f60.png
URLScan capture report: https://urlscan.io/result/01a17901-d500-71c0-9cc1-640420d40f60/
URLScan screenshot (2026-10-26T16:24:38Z): https://screenshots.phishdestroy.io/us/01a17907-117d-738b-abb3-681ab06c4d00.png
URLScan capture report: https://urlscan.io/result/01a17907-117d-738b-abb3-681ab06c4d00/
URLScan screenshot (2026-10-26T16:32:33Z): https://screenshots.phishdestroy.io/us/01a1790c-a726-77ac-b847-b7d78c3ba97c.png
URLScan capture report: https://urlscan.io/result/01a1790c-a726-77ac-b847-b7d78c3ba97c/
URLScan screenshot (2026-10-26T17:43:34Z): https://screenshots.phishdestroy.io/us/01a1794f-3e55-7118-b987-5cb031e803ec.png
URLScan capture report: https://urlscan.io/result/01a1794f-3e55-7118-b987-5cb031e803ec/
VirusTotal report: https://www.virustotal.com/gui/domain/tokeimx-cdn22-hk22.sbs
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=tokeimx-cdn22-hk22.sbs
Archived copy: https://web.archive.org/web/20261026161715/https://tokeimx-cdn22-hk22.sbs/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:14:44 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/5hyJwgf7/57afdc7ea6c1.png
  Captured: 2026-10-26 16:31:34 UTC
- URLScan capture 1: https://urlscan.io/screenshots/01a1790b-5806-747f-a391-c7690d2810d2.png
  Captured: 2026-10-26 16:31:34 UTC
  Source report: https://urlscan.io/result/01a1790b-5806-747f-a391-c7690d2810d2/
- URLScan capture 2: https://screenshots.phishdestroy.io/01a1784c-a9de-731b-bd38-d896bea8a719.png
  Captured: 2026-10-26 16:15:14 UTC
  Source report: https://urlscan.io/result/01a1790b-5806-747f-a391-c7690d2810d2/
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17706-e17d-75bc-b39a-bc76ecf64b38.png
  Captured: 2026-10-26 07:05:34 UTC
  Source report: https://urlscan.io/result/01a17706-e17d-75bc-b39a-bc76ecf64b38/
  SHA-256: f297e9689471b9352168a2d24b894f6d12c72455f5e0e602ef0fd913b5de4817
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17901-d500-71c0-9cc1-640420d40f60.png
  Captured: 2026-10-26 16:21:39 UTC
  Source report: https://urlscan.io/result/01a17901-d500-71c0-9cc1-640420d40f60/
  SHA-256: f297e9689471b9352168a2d24b894f6d12c72455f5e0e602ef0fd913b5de4817
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17907-117d-738b-abb3-681ab06c4d00.png
  Captured: 2026-10-26 16:24:38 UTC
  Source report: https://urlscan.io/result/01a17907-117d-738b-abb3-681ab06c4d00/
  SHA-256: f297e9689471b9352168a2d24b894f6d12c72455f5e0e602ef0fd913b5de4817
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a1790c-a726-77ac-b847-b7d78c3ba97c.png
  Captured: 2026-10-26 16:32:33 UTC
  Source report: https://urlscan.io/result/01a1790c-a726-77ac-b847-b7d78c3ba97c/
  SHA-256: f297e9689471b9352168a2d24b894f6d12c72455f5e0e602ef0fd913b5de4817
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a1794f-3e55-7118-b987-5cb031e803ec.png
  Captured: 2026-10-26 17:43:34 UTC
  Source report: https://urlscan.io/result/01a1794f-3e55-7118-b987-5cb031e803ec/
  SHA-256: f297e9689471b9352168a2d24b894f6d12c72455f5e0e602ef0fd913b5de4817
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/217afe6f-f22b-40b1-8500-63b9bea2034f.png
  Captured: 2026-10-26 16:19:38 UTC
  Source report: https://radar.cloudflare.com/scan/217afe6f-f22b-40b1-8500-63b9bea2034f
  SHA-256: 6fbabdb5f5c442d7bc956c2fd516341a692e1d10a98c2d3f2b0aed6454823d56
- URLQuery: https://screenshots.phishdestroy.io/uq/2106f5e1-763f-422c-9ba9-57bf9df6ae60.png
  Source report: https://urlquery.net/report/2106f5e1-763f-422c-9ba9-57bf9df6ae60
  SHA-256: 57afa6477ed7432fd96be5603936a8ed7fd6840eb5d7a8942fa862e046e3abb1
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a1784c-a9de-731b-bd38-d896bea8a719.png
  Captured: 2026-10-26 13:01:01 UTC
  Source report: https://urlscan.io/result/01a1784c-a9de-731b-bd38-d896bea8a719/
  SHA-256: f297e9689471b9352168a2d24b894f6d12c72455f5e0e602ef0fd913b5de4817

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T16:33:11Z",
        "uuid": "01a1790b-5806-747f-a391-c7690d2810d2",
        "scanned_at": "2026-10-26T16:31:20Z",
        "final_url": "https://tokeimx-cdn22-hk22.sbs/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://tokeimx-cdn22-hk22.sbs/",
                "from": "http://tokeimx-cdn22-hk22.sbs/",
                "status": 307
            }
        ],
        "ip": "149.88.95.146",
        "ips": [
            "149.88.95.146"
        ],
        "asns": [
            "401696"
        ],
        "countries": [
            "HK"
        ],
        "link_domains": [
            "shop42404838.m.youzan.com",
            "www.ethereum.org",
            "polkadot.network",
            "cosmos.network",
            "entethalliance.org",
            "new.consensys.net",
            "etherscan.io",
            "walletconnect.com",
            "zksync.io",
            "slowmist.com",
            "imtoken.fans"
        ],
        "doc_hash": "59986b9696c6fb5a407ab64773a27fb9ddd8ee040be7e9929a9bf8d9cb88044a",
        "cookies": [
            "PHPSESSID",
            "server_session_c098fd19"
        ],
        "tls": {
            "san": [
                "tokeimx-cdn22-hk22.sbs"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR2",
            "subject": "tokeimx-cdn22-hk22.sbs",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-22T16:35:35Z",
            "valid_from": "2026-10-24T16:35:36Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 28,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "imtoken"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "imToken"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html; charset=UTF-8",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T16:25:50Z",
        "uuid": "217afe6f-f22b-40b1-8500-63b9bea2034f",
        "scanned_at": "2026-10-26T16:19:38Z",
        "final_url": "https://tokeimx-cdn22-hk22.sbs/",
        "status": 200,
        "history": [
            {
                "url": "https://tokeimx-cdn22-hk22.sbs/",
                "status": 200
            }
        ],
        "dom_hash": "2b778d95bd046bd7819602551d209710e43b3179b1f709d616ae9d792bf2a02f",
        "doc_hash": "59986b9696c6fb5a407ab64773a27fb9ddd8ee040be7e9929a9bf8d9cb88044a",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains",
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "tokeimx-cdn22-hk22.sbs",
                "type": "CNAME",
                "value": "7vm4nq5y.ikunzf.online"
            },
            {
                "name": "tokeimx-cdn22-hk22.sbs",
                "type": "CNAME",
                "value": "7vm4nq5y.ikunzf.online"
            }
        ],
        "dnssec_valid": false,
        "ip": "149.88.95.146",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-10-24T17:28:10Z",
            "updated": "2026-10-24T17:28:28Z",
            "expires": "2027-10-24T23:59:59Z",
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T16:17:54Z",
        "analysis_at": "2026-10-26T14:25:03Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 1,
            "suspicious": 1,
            "undetected": 36
        },
        "detections": {
            "SOCRadar": "suspicious",
            "OpenPhish": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "Dynadot Inc",
        "created": "2026-10-24T17:28:10Z",
        "expires": "2027-10-24T23:59:59Z",
        "updated": "2026-10-24T17:28:28Z",
        "first_seen": "2026-10-24T17:39:01Z",
        "dns": [
            {
                "ttl": 1,
                "type": "CNAME",
                "value": "z6pnwmjk.ikunzf.online"
            },
            {
                "ttl": 300,
                "type": "CNAME",
                "value": "7vm4nq5y.ikunzf.online"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.tokeimx-cdn22-hk22.sbs",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 1,
                "type": "A",
                "value": "149.88.95.146"
            }
        ],
        "dns_at": "2026-10-26T14:29:58Z",
        "jarm": "29d29d00029d29d21c42d42d000000bdfc58c9a46434368cf60aa440385763",
        "cert": {
            "san": [
                "tokeimx-cdn22-hk22.sbs"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "6d0e89001cedbaaa19c2c3337fd13db7806",
            "sha256": "c65ff35b07fadacd3e78cf830ad66b7d9deddda583c3e705c31cd894161a2c39",
            "subject": "tokeimx-cdn22-hk22.sbs",
            "valid_to": "2027-01-22T16:35:35Z",
            "valid_from": "2026-10-24T16:35:36Z"
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "registrar_iana_id": "472",
            "registrar_url": "http://www.dynadot.com",
            "created": "2026-10-24T17:28:10Z",
            "updated": "2026-10-24T17:28:28Z",
            "expires": "2027-10-24T23:59:59Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T16:26:10Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "tokeimx-cdn22-hk22.sbs"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-26T16:17:15Z",
            "first": "2026-10-26T16:17:15Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 4437
        },
        "social_tags": {
            "title": "imToken | Ethereum & Bitcoin Wallet",
            "keywords": "Bitcoin, Ethereum, BNB Chain, Tron, Polkadot, Polygon, Litecoin, Bitcoin Cash, Cosmos, Optimism, Filecoin, Arbitrum, EOS, Kusama, Tezos, Nervos, Staking, Tokenlon, imKey, Price, Blockchain, Crypto Wallet, DeFi, NFT, cryptocurrency, hardware wallet, cold wallet, Web3",
            "description": "imToken  ，一款安全放心、简单易用的数字钱包，超千万用户信赖. It supports BTC, ETH, BNB, TRX, DOT, MATIC, LTC, BCH, ATOM, OP, FIL, ARB, EOS, KSM, XTZ, CKB and many other tokens. It also allows you to swap token and use DApp right from the wallet"
        },
        "trackers": {
            "requests": 26
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 208,
                "tls": 203,
                "wait": 347,
                "connect": 200,
                "download": 0
            },
            "response_ms": 958
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 9315,
            "co2_grams": 0.0003,
            "cleaner_than": 73
        },
        "cookies": {
            "cookies": [
                {
                    "name": "PHPSESSID",
                    "session": true,
                    "http_only": true
                },
                {
                    "name": "server_session_c098fd19",
                    "http_only": true
                }
            ]
        },
        "location": {
            "ip": "149.88.95.146",
            "asn": "401701",
            "org": "cognetcloud INC",
            "city": "Kwai Chung",
            "country": "HK"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR2",
            "subject": "tokeimx-cdn22-hk22.sbs"
        },
        "dns": {
            "A": [
                "149.88.95.146"
            ],
            "CNAME": [
                "7vm4nq5y.ikunzf.online"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": true
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "149.88.95.146",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://tokeimx-cdn22-hk22.sbs"
            ]
        },
        "linked_pages": {
            "external": [
                "https://shop42404838.m.youzan.com/v2/feature/d5bMdxB3Ab",
                "https://www.ethereum.org/",
                "https://polkadot.network/",
                "https://cosmos.network/",
                "https://entethalliance.org/",
                "https://new.consensys.net/",
                "https://etherscan.io/",
                "https://walletconnect.com/",
                "https://zksync.io/",
                "https://slowmist.com/",
                "https://imtoken.fans/"
            ],
            "external_count": 11,
            "internal_count": 8
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-10-24T17:28:10Z",
            "updated": "2026-10-24T17:28:28Z",
            "expires": "2027-10-24T23:59:59Z",
            "status": [
                "serverTransferProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp",
                "addPeriod https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html; charset=UTF-8",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```