# PhishDestroy domain threat record: wqoewoqo.christmas

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/wqoewoqo.christmas/
Machine-readable companion: https://phishdestroy.io/domain/wqoewoqo.christmas/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 16:16:45 UTC
- Last availability or vendor check: 2026-10-25 16:33:39 UTC
- Stored record updated: 2026-10-25 19:30:48 UTC
- VirusTotal detections in the stored snapshot: 9/92
- Independent public blocklist matches in the stored snapshot: 1
- Matching public blocklists: OpenPhish
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: imToken

## Stored infrastructure

- Observed IP address: 149.88.95.146
- Registrar in stored WHOIS data: Spaceship, Inc.
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a173e7-3d2c-757a-81a7-c2f27fa588ae/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/wqoewoqo.christmas
- Certificate Transparency search: https://crt.sh/?q=%25.wqoewoqo.christmas
- Web Archive lookup: https://web.archive.org/web/*/https://wqoewoqo.christmas/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI classified the page as malicious because it impersonates the imToken brand and offers a wallet download. The recorded page title reads “imToken | Ethereum & Bitcoin Wallet” and the page repeats imToken branding with a call to “立即下载”. The page was first seen by PhishDestroy on 2026-10-25, two days after the domain was registered on 2026-10-23, and returned HTTP 200 at that time.

How the scam works
In a wallet‑phishing attack the adversary reproduces the look of a legitimate crypto‑wallet service and provides a download that contains malware or a compromised client. Once installed, the fake app can capture private keys, seed phrases or approve unauthorized transactions, enabling theft of the victim’s assets.

Evidence
URLScan captured the site on 2026-10-25 and gave it a malicious verdict with a score of 100, categorising it as phishing and flagging the imToken brand. VirusTotal analysis on the same day reported 9 malicious detections out of 92 engines, with vendors such as BitDefender, ESET and Fortinet labeling it as phishing or malicious. Google Safe Browsing checked the URL on 2026-10-25 and did not flag it. The domain appears on the external OpenPhish blocklist and is listed in PhishDestroy’s internal blocklist, both confirmed on 2026-10-25; OTX recorded zero pulses.

Infrastructure
The domain was registered with Spaceship, Inc. on 2026-10-23 and uses the nameservers launch1.spaceship.net and launch2.spaceship.net. Recorded hosting IPs are 111.92.242.95 (cognetcloud INC, HK) and 149.88.95.146, both observed on 2026-10-25. TLS was provided by Let’s Encrypt, valid from 2026-10-23 to 2027-01-21, and DNSSEC is enabled for the zone.

What to do
Do not download or install any software offered on the site; if any credentials or seed phrases were entered, treat them as compromised and create a new wallet with a fresh recovery phrase. Users should change any passwords associated with the imToken service. Defenders should block wqoewoqo.christmas at DNS and proxy layers, monitor for connections to the recorded IP addresses, and add the domain to internal blocklists and security monitoring dashboards.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17329-0231-773b-ae32-fe47b49ab4a3/
Cloudflare Radar report: https://radar.cloudflare.com/scan/9fea5b52-d079-4bd0-8636-03b81f82b7ff
Stored capture screenshot: https://urlscan.io/screenshots/01a17329-0231-773b-ae32-fe47b49ab4a3.png
Cloudflare Radar screenshot (2026-10-25T16:27:31Z): https://screenshots.phishdestroy.io/cf/9fea5b52-d079-4bd0-8636-03b81f82b7ff.png
URLScan screenshot (2026-10-25T16:31:44Z): https://screenshots.phishdestroy.io/us/01a173e7-3d2c-757a-81a7-c2f27fa588ae.png
URLScan capture report: https://urlscan.io/result/01a173e7-3d2c-757a-81a7-c2f27fa588ae/
VirusTotal report: https://www.virustotal.com/gui/domain/wqoewoqo.christmas
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=wqoewoqo.christmas
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 16:33:21 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a173e7-3d2c-757a-81a7-c2f27fa588ae.png
  Captured: 2026-10-25 16:33:39 UTC
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a173e7-3d2c-757a-81a7-c2f27fa588ae.png
  Captured: 2026-10-25 16:31:44 UTC
  Source report: https://urlscan.io/result/01a173e7-3d2c-757a-81a7-c2f27fa588ae/
  SHA-256: f297e9689471b9352168a2d24b894f6d12c72455f5e0e602ef0fd913b5de4817
- URLScan capture 2: https://urlscan.io/screenshots/01a17329-0231-773b-ae32-fe47b49ab4a3.png
  Captured: 2026-10-25 16:16:45 UTC
  Source report: https://urlscan.io/result/01a173e7-3d2c-757a-81a7-c2f27fa588ae/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/9fea5b52-d079-4bd0-8636-03b81f82b7ff.png
  Captured: 2026-10-25 16:27:31 UTC
  Source report: https://radar.cloudflare.com/scan/9fea5b52-d079-4bd0-8636-03b81f82b7ff
  SHA-256: 4456e3c963d3ced9aa6033518d9751c7696c75f4d1d863b9578e6452d4c55e61

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T17:32:13Z",
        "uuid": "01a173e7-3d2c-757a-81a7-c2f27fa588ae",
        "scanned_at": "2026-10-25T16:31:44Z",
        "final_url": "https://wqoewoqo.christmas/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://wqoewoqo.christmas/",
                "from": "http://wqoewoqo.christmas/",
                "status": 307
            }
        ],
        "ip": "149.88.95.146",
        "ips": [
            "149.88.95.146"
        ],
        "asns": [
            "401696"
        ],
        "countries": [
            "HK"
        ],
        "link_domains": [
            "shop42404838.m.youzan.com",
            "www.ethereum.org",
            "polkadot.network",
            "cosmos.network",
            "entethalliance.org",
            "new.consensys.net",
            "etherscan.io",
            "walletconnect.com",
            "zksync.io",
            "slowmist.com",
            "imtoken.fans"
        ],
        "doc_hash": "59986b9696c6fb5a407ab64773a27fb9ddd8ee040be7e9929a9bf8d9cb88044a",
        "cookies": [
            "PHPSESSID",
            "server_session_c098fd19"
        ],
        "tls": {
            "san": [
                "wqoewoqo.christmas"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR2",
            "subject": "wqoewoqo.christmas",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-21T18:22:01Z",
            "valid_from": "2026-10-23T18:22:02Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 28,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "imtoken"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "imToken"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html; charset=UTF-8",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T16:32:45Z",
        "uuid": "9fea5b52-d079-4bd0-8636-03b81f82b7ff",
        "scanned_at": "2026-10-25T16:27:31Z",
        "final_url": "https://wqoewoqo.christmas/",
        "status": 200,
        "history": [
            {
                "url": "https://wqoewoqo.christmas/",
                "status": 200
            }
        ],
        "dom_hash": "2b778d95bd046bd7819602551d209710e43b3179b1f709d616ae9d792bf2a02f",
        "doc_hash": "59986b9696c6fb5a407ab64773a27fb9ddd8ee040be7e9929a9bf8d9cb88044a",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "DGA Domains",
            "Security threats",
            "Phishing",
            "New Domains",
            "Security Risks",
            "Newly Seen Domains",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "wqoewoqo.christmas",
                "type": "A",
                "value": "149.88.95.146"
            }
        ],
        "dnssec_valid": true,
        "ip": "149.88.95.146",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "created": "2026-10-23T18:48:12Z",
            "updated": "2026-10-23T18:48:13Z",
            "expires": "2027-10-23T23:59:59Z",
            "nameservers": [
                "launch2.spaceship.net",
                "launch1.spaceship.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T16:26:23Z",
        "analysis_at": "2026-10-25T06:13:55Z",
        "stats": {
            "timeout": 0,
            "harmless": 47,
            "malicious": 9,
            "suspicious": 0,
            "undetected": 36
        },
        "detections": {
            "CRDF": "malicious",
            "ESET": "phishing",
            "G-Data": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "registrar": "Spaceship, Inc.",
        "created": "2026-10-23T18:48:12Z",
        "expires": "2027-10-23T23:59:59Z",
        "updated": "2026-10-23T18:48:13Z",
        "first_seen": "2026-10-23T19:25:42Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "support.spaceship.com",
                "value": "launch1.spaceship.net"
            },
            {
                "ttl": 1800,
                "type": "NS",
                "value": "launch1.spaceship.net"
            },
            {
                "ttl": 1800,
                "type": "NS",
                "value": "launch2.spaceship.net"
            },
            {
                "ttl": 1800,
                "type": "A",
                "value": "149.88.95.146"
            }
        ],
        "dns_at": "2026-10-25T06:14:21Z",
        "jarm": "29d29d00029d29d21c42d42d000000bdfc58c9a46434368cf60aa440385763",
        "cert": {
            "san": [
                "wqoewoqo.christmas"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "51ecd5210189937da78da446c6e7aaa1d01",
            "sha256": "5f7e7764fbecb6cc8dbe455ec95ba11229e3c30b035a868fc27a2890b079f981",
            "subject": "wqoewoqo.christmas",
            "valid_to": "2027-01-21T18:22:01Z",
            "valid_from": "2026-10-23T18:22:02Z"
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "registrar_iana_id": "3862",
            "registrar_url": "https://www.spaceship.com/",
            "created": "2026-10-23T18:48:12Z",
            "updated": "2026-10-23T18:48:13Z",
            "expires": "2027-10-23T23:59:59Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "launch1.spaceship.net",
                "launch2.spaceship.net"
            ],
            "dnssec": "signedDelegation"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T16:33:00Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "wqoewoqo.christmas"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "social_tags": {
            "title": "imToken | Ethereum & Bitcoin Wallet",
            "keywords": "Bitcoin, Ethereum, BNB Chain, Tron, Polkadot, Polygon, Litecoin, Bitcoin Cash, Cosmos, Optimism, Filecoin, Arbitrum, EOS, Kusama, Tezos, Nervos, Staking, Tokenlon, imKey, Price, Blockchain, Crypto Wallet, DeFi, NFT, cryptocurrency, hardware wallet, cold wallet, Web3",
            "description": "imToken  ，一款安全放心、简单易用的数字钱包，超千万用户信赖. It supports BTC, ETH, BNB, TRX, DOT, MATIC, LTC, BCH, ATOM, OP, FIL, ARB, EOS, KSM, XTZ, CKB and many other tokens. It also allows you to swap token and use DApp right from the wallet"
        },
        "trackers": {
            "requests": 25
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 1876,
                "tls": 219,
                "wait": 252,
                "connect": 224,
                "download": 1
            },
            "response_ms": 2572
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "carbon": {
            "bytes": 9315,
            "co2_grams": 0.0003,
            "cleaner_than": 73
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.27.32",
                    "host": "launch2.spaceship.net"
                },
                {
                    "ip": "162.159.26.38",
                    "host": "launch1.spaceship.net"
                }
            ],
            "zone": "wqoewoqo.christmas"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "PHPSESSID",
                    "session": true,
                    "http_only": true
                },
                {
                    "name": "server_session_c098fd19",
                    "http_only": true
                }
            ]
        },
        "location": {
            "ip": "111.92.242.95",
            "asn": "401696",
            "org": "cognetcloud INC",
            "country": "HK"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR2",
            "subject": "wqoewoqo.christmas"
        },
        "dns": {
            "A": [
                "111.92.242.95"
            ],
            "NS": [
                "launch2.spaceship.net",
                "launch1.spaceship.net"
            ],
            "SOA": "{\"nsname\": \"launch1.spaceship.net\", \"hostmaster\": \"support.spaceship.com\", \"serial\": 1792781808, \"refresh\": 43200, \"retry\": 3600, \"expire\": 604800, \"minttl\": 3600}"
        },
        "dnssec": {
            "ds": true,
            "rrsig": true,
            "dnskey": true
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "111.92.242.95",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://wqoewoqo.christmas"
            ]
        },
        "linked_pages": {
            "external": [
                "https://shop42404838.m.youzan.com/v2/feature/d5bMdxB3Ab",
                "https://www.ethereum.org/",
                "https://polkadot.network/",
                "https://cosmos.network/",
                "https://entethalliance.org/",
                "https://new.consensys.net/",
                "https://etherscan.io/",
                "https://walletconnect.com/",
                "https://zksync.io/",
                "https://slowmist.com/",
                "https://imtoken.fans/"
            ],
            "external_count": 11,
            "internal_count": 8
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "created": "2026-10-23T18:48:12Z",
            "updated": "2026-10-23T18:48:13Z",
            "expires": "2027-10-23T23:59:59Z",
            "status": [
                "serverTransferProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp",
                "addPeriod https://icann.org/epp"
            ],
            "nameservers": [
                "launch2.spaceship.net",
                "launch1.spaceship.net"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html; charset=UTF-8",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```