# PhishDestroy domain threat record: wsjj.njztb.cn

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/wsjj.njztb.cn/
Machine-readable companion: https://phishdestroy.io/domain/wsjj.njztb.cn/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-19 01:23:00 UTC
- Last availability or vendor check: 2026-10-22 10:34:27 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 16/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: okx

## Stored infrastructure

- Observed IP address: 91.110.250.238
- Registrar in stored WHOIS data: WEST263 INTERNATIONAL LIMITED
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2009-04-11 07:42:22 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a14d56-9d07-767a-af85-15c45f697b4a/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/wsjj.njztb.cn
- Certificate Transparency search: https://crt.sh/?q=%25.wsjj.njztb.cn
- Web Archive lookup: https://web.archive.org/web/*/https://wsjj.njztb.cn/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The domain wsjj.njztb.cn imitates an ImToken wallet download page, as indicated by its page title: 'imtoken最新官网下载-imtoken官方钱包app-imtoken安卓版下载|全球领先的数字货币钱包'. This site likely targets cryptocurrency users seeking the ImToken wallet. PhishDestroy first observed this domain on 2026-10-19. Its current content and site status are unknown.

How the scam works
Sites impersonating legitimate cryptocurrency wallet providers like ImToken often attempt to trick visitors into downloading malicious software or revealing their wallet credentials. If a user downloads an application from such a site, it could be a wallet drainer designed to steal digital assets, or a phishing page collecting private keys and seed phrases. Engaging with this site could lead to the loss of cryptocurrency funds.

Evidence
VirusTotal reported 16 detections out of 92 security engines for wsjj.njztb.cn on 2026-10-19. Vendors flagging the domain include BitDefender, CyRadar, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data, and Gridinsoft. PhishDestroy has added this domain to its blocklist.

Infrastructure
The domain wsjj.njztb.cn is hosted on IP 91.110.250.238, associated with the AS40065 CNSERVERS LLC network in Hong Kong. Its TLS certificate was issued by Certum DV TLS G2 R39 CA.

What to do
Users who visited wsjj.njztb.cn should avoid downloading any files or entering personal information. If you have entered credentials or connected a wallet, immediately change passwords for any associated accounts and revoke permissions for any connected crypto wallets. Security teams should block this domain at the network perimeter and investigate any related activity.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a14d56-9d07-767a-af85-15c45f697b4a/
VirusTotal report: https://www.virustotal.com/gui/domain/wsjj.njztb.cn
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=wsjj.njztb.cn
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 06:49:37 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a14d56-9d07-767a-af85-15c45f697b4a.png
  Captured: 2026-10-19 01:23:00 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a14d56-9d07-767a-af85-15c45f697b4a.png
  Captured: 2026-10-19 03:30:11 UTC
  Source report: https://urlscan.io/result/01a14d56-9d07-767a-af85-15c45f697b4a/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/0b103b00-c86b-4bb5-9a83-2b33bc304e3f.png
  Captured: 2026-10-19 01:24:41 UTC
  Source report: https://radar.cloudflare.com/scan/0b103b00-c86b-4bb5-9a83-2b33bc304e3f
  SHA-256: 721e5766f73d5c145c57d01fc372e6011a16332081ac5654c1b4330af9b7e97c
- URLScan · 2026-09-26: https://screenshots.phishdestroy.io/us/01a0de13-95e3-75c1-ae77-9f2cfd62399e.png
  Captured: 2026-09-26 14:17:13 UTC
  Source report: https://urlscan.io/result/01a0de13-95e3-75c1-ae77-9f2cfd62399e/
  SHA-256: c2b9b04092af111b0492aacc36cccd52e5bf07ae0bde8a91a1fcda29fbc78413
- URLScan · 2026-09-30: https://screenshots.phishdestroy.io/us/01a0f345-8020-7289-8c99-520a47dd8cf0.png
  Captured: 2026-09-30 17:03:46 UTC
  Source report: https://urlscan.io/result/01a0f345-8020-7289-8c99-520a47dd8cf0/
  SHA-256: 20cc2510e0fed5362ac78b7815d57e953377bcc5051eb7b42619d62df2e06a29
- URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a14c8a-912f-72c6-b483-0aa95bbb0a39.png
  Captured: 2026-10-18 01:05:21 UTC
  Source report: https://urlscan.io/result/01a14c8a-912f-72c6-b483-0aa95bbb0a39/
  SHA-256: 49367cb1c4e1724302b9df6033cd9dc5aec249f1af981404f22b03c1dfad31ee
- URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a151c1-fd79-72a4-b8e9-6e598c237277.png
  Captured: 2026-10-19 01:24:00 UTC
  Source report: https://urlscan.io/result/01a151c1-fd79-72a4-b8e9-6e598c237277/
  SHA-256: 5784ba2f4afecfd7d3e751c9ee6d06c2e12c501617c9516975dcd5223ea5d3e7

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T16:45:00Z",
        "uuid": "01a14d56-9d07-767a-af85-15c45f697b4a",
        "scanned_at": "2026-10-18T04:48:17Z",
        "final_url": "https://wsjj.njztb.cn/njcg/zfcgztbmis_neijiang/pages/gonggaolist/gonggao_detail.aspx",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://wsjj.njztb.cn/njcg/zfcgztbmis_neijiang/pages/gonggaolist/gonggao_detail.aspx",
                "from": "http://wsjj.njztb.cn/njcg/zfcgztbmis_neijiang/pages/gonggaolist/gonggao_detail.aspx",
                "status": 307
            }
        ],
        "ip": "91.110.250.238",
        "domains": [
            "njztb.cn",
            "sodmsizn.mmxihzuxbbdgqvsyq5512d.cc"
        ],
        "ips": [
            "23.225.61.100",
            "91.110.250.238"
        ],
        "asns": [
            "40065"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "njztb.cn"
        ],
        "doc_hash": "1c6e7017485e3b510f007b8424952a00075487329a6ede3af85c809ef226da61",
        "script_hashes": [
            "b409c14a10b4caad6b54844aa63a5faf748b83eecc2dd0d4fb1d913f8de55365",
            "11b10a45b9fc3622b9a8eaf5181e0bd403af74ecfbbc9541cdce396a8e47b332",
            "62b0f9486906d9000ad684141e846ff4551c388ad01681074d5cd5162a1e7ac5",
            "ecab9a8cc9e414e313f339517c1a46f76003c388643d7f258b86a23d8110aaf0",
            "1c6e7017485e3b510f007b8424952a00075487329a6ede3af85c809ef226da61",
            "c4ae1f4a75c230b5bfa2e67e84ba67425fec6b5bd241d3c8e0b0791f465f5ceb",
            "5867cef615756cb75b523c11e29d88f770ddb40fd51bc39cd60e3ba86d004fdc"
        ],
        "globals": [
            "$",
            "jQuery",
            "ZBP",
            "zbpConfig",
            "zbp",
            "bloghost",
            "cookiespath",
            "ajaxurl",
            "lang_comment_name_error",
            "lang_comment_email_error",
            "lang_comment_content_error",
            "_self",
            "Prism",
            "heartBeat",
            "lastScrollY",
            "suspendcode",
            "percent",
            "$ssimg",
            "$simg",
            "_0x509a",
            "uEHDAD",
            "_0x186d"
        ],
        "cookies": [
            "timezone"
        ],
        "tls": {
            "san": [
                "*.njztb.cn",
                "njztb.cn"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "Certum DV TLS G2 R39 CA",
            "subject": "*.njztb.cn",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-30T14:06:40Z",
            "valid_from": "2026-06-14T14:06:41Z"
        },
        "domain_age_days": 23,
        "apex_age_days": 3426,
        "tls_age_days": 125,
        "tls_valid_days": 198,
        "requests": 25,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 96,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "openresty",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=63072000;includeSubDomains; preload"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T17:56:05Z",
        "uuid": "0b103b00-c86b-4bb5-9a83-2b33bc304e3f",
        "scanned_at": "2026-10-19T01:24:41Z",
        "final_url": "https://wsjj.njztb.cn/",
        "status": 200,
        "history": [
            {
                "url": "https://wsjj.njztb.cn/",
                "status": 200
            }
        ],
        "dom_hash": "534fcf6ac1e8c0f539fb507bdf635f6b1a94b63831da221004e270967fab937c",
        "doc_hash": "e75c4f42865257c6a923fc2d19d30625ea6f4b9935d7d8d67671ca6aebbac630",
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "njztb.cn",
                "type": "A",
                "value": "91.110.250.238"
            },
            {
                "name": "wsjj.njztb.cn",
                "type": "A",
                "value": "91.110.250.238"
            }
        ],
        "dnssec_valid": false,
        "ip": "91.110.250.238",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "WEST263 INTERNATIONAL LIMITED",
            "created": "2009-04-11T11:42:22Z",
            "expires": "2028-04-11T11:42:22Z",
            "nameservers": [
                "ns1.dnsip.com",
                "ns2.dnsip.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-20T18:07:22Z",
        "analysis_at": "2026-10-20T16:51:45Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 16,
            "suspicious": 0,
            "undetected": 30
        },
        "detections": {
            "ESET": "phishing",
            "VIPRE": "malware",
            "G-Data": "malware",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Gridinsoft": "phishing",
            "SafeToOpen": "phishing",
            "BitDefender": "malware",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "first_seen": "2025-10-24T07:43:32Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "91.110.250.238"
            }
        ],
        "dns_at": "2026-10-20T16:52:16Z",
        "jarm": "2ad2ad0002ad2ad00042d43d0000002059a3b916699461c5923779b77cf06b",
        "cert": {
            "san": [
                "*.njztb.cn",
                "njztb.cn"
            ],
            "issuer": "Asseco Data Systems S.A. / Certum DV TLS G2 R39 CA",
            "serial": "5d608d0528e9f5a595e499fd5632bd32",
            "sha256": "a50027a51afb6761d5a49ce497b350cc6727f1175bc23815a820c9770d926aa9",
            "subject": "*.njztb.cn",
            "valid_to": "2026-12-30T14:06:40Z",
            "valid_from": "2026-06-14T14:06:41Z"
        },
        "whois": {
            "status": [
                "ok"
            ],
            "nameservers": [
                "ns1.dnsip.com",
                "ns2.dnsip.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T03:44:39Z",
        "caa_records": {
            "domain": "wsjj.njztb.cn"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-19T01:28:52Z",
            "first": "2018-03-14T08:46:40Z",
            "changes": 1,
            "days_archived": 5,
            "scans_per_day": 0,
            "avg_page_bytes": 2756
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true
        },
        "sitemap": {
            "present": true,
            "url_count": 5000
        },
        "social_tags": {
            "ogUrl": "https://wsjj.njztb.cn/",
            "title": "imtoken最新官网下载-imtoken官方钱包app-imtoken安卓版下载|全球领先的数字货币钱包",
            "ogType": "article",
            "ogTitle": "imtoken最新官网下载-imtoken官方钱包app-imtoken安卓版下载|全球领先的数字货币钱包",
            "keywords": "imtoken最新官网下载,imtoken官网app下载,imtoken最新版安装,imtoken官方app,imtoken官方下载,imtoken钱包下载链接,imtoken免费,imtoken官网网址",
            "ogSiteName": "内江市公共资源",
            "description": "ImToken最新版官方下载,支持多链资产管理、安全私钥存储,是全球领先的数字货币钱包应用。无论你是比特币、以太坊或其他主流代币用户,ImToken都为你提供便捷的资产转账、DApp访问与DeFi交互体验。支持安卓版系统一键下载安装,界面清晰、使用流畅,保障资金安全。现在就下载官方正版ImToken钱包,开启你的区块链数字资产管理之旅。",
            "ogDescription": "ImToken最新版官方下载,支持多链资产管理、安全私钥存储,是全球领先的数字货币钱包应用。无论你是比特币、以太坊或其他主流代币用户,ImToken都为你提供便捷的资产转账、DApp访问与DeFi交互体验。支持安卓版系统一键下载安装,界面清晰、使用流畅,保障资金安全。现在就下载官方正版ImToken钱包,开启你的区块链数字资产管理之旅。"
        },
        "trackers": {
            "requests": 21
        },
        "mixed_content": {
            "no_sri": [
                "https://sodmsizn.mmxihzuxbbdgqvsyq5512d.cc/im/a9xp1g.js"
            ],
            "third_party_scripts": 1
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 1265,
                "tls": 210,
                "wait": 574,
                "connect": 184,
                "download": 2
            },
            "response_ms": 2235
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80
            ]
        },
        "carbon": {
            "bytes": 44141,
            "co2_grams": 0.0016,
            "cleaner_than": 40
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "218.98.111.202",
                    "host": "ns1.dnsip.com"
                },
                {
                    "ip": "211.99.99.33",
                    "host": "ns2.dnsip.com"
                }
            ],
            "zone": "njztb.cn"
        },
        "location": {
            "ip": "91.110.250.238",
            "asn": "40065",
            "org": "Cnservers LLC",
            "city": "Martlesham",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Asseco Data Systems S.A. / Certum DV TLS G2 R39 CA",
            "subject": "*.njztb.cn"
        },
        "dns": {
            "A": [
                "91.110.250.238"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=63072000;includeSubDomains; preload",
            "message": "Site is compatible with the HSTS preload list!",
            "compatible": true
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": "1; mode=block",
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=63072000;includeSubDomains; preload",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "91.110.250.238",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://wsjj.njztb.cn"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Nginx",
                "OpenResty",
                "jQuery",
                "Font Awesome",
                "HSTS",
                "Prism",
                "RSS",
                "Open Graph"
            ]
        },
        "linked_pages": {
            "external": [
                "https://njztb.cn/"
            ],
            "external_count": 1,
            "internal_count": 82
        },
        "whois": {
            "registrar": "WEST263 INTERNATIONAL LIMITED",
            "created": "2009-04-11T09:42:22Z",
            "expires": "2028-04-11T09:42:22Z",
            "status": [
                "ok"
            ],
            "nameservers": [
                "ns1.dnsip.com",
                "ns2.dnsip.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "openresty",
                "content-type": "text/html; charset=utf-8",
                "strict-transport-security": "max-age=63072000;includeSubDomains; preload"
            }
        }
    }
}
```