imtokencn-web[.]com

Analysis indicates that the domain imtokencn-web.com is an active phishing site flagged for high-risk brand impersonation, specifically targeting cryptocurrency users through an Airdrop Scam kit. Registered on March 21, 2026, via TuringSign Inc. d/b/a Cosmotown, the domain resolves to the IP address 177.211.126.41, hosted in Hong Kong under HongKong Service. Infrastructure analysis reveals the use of Nginx with HSTS and HTTP/3 enabled, alongside an SSL certificate issued by TrustAsia Technologies, Inc. under the LiteSSL RSA CA 2025 chain. The domain is currently operational, returning an HTTP 200 status despite displaying a '404 Not Found' page title, a discrepancy that may indicate cloaking or an incomplete deployment of the phishing kit. Nameservers are configured under domainnamedns.com (ns1 through ns4), a pattern observed in other fraudulent domains managed by the same registrar. At the time of assessment, 8 of 91 security vendors on VirusTotal have flagged the domain, and it appears on at least one security blocklist. Defenders should note that the Gridinsoft trust score for this domain is 0/100, reinforcing its classification as malicious. The exact brand being impersonated is not explicitly named in available data, but the presence of an Airdrop Scam kit suggests an attempt to deceive users into interacting with fraudulent token distribution schemes. While the domain remains active, its current 404 presentation may represent a transitional state; monitoring for changes in page content or redirection behavior is recommended. Immediate blocking of the domain and associated IP is advised for organizations seeking to mitigate exposure to this campaign.