imokenu[.]com

imokenu.com is an active domain observed on July 12, 2026 that is classified as a high‑risk brand‑impersonation campaign targeting the cryptocurrency ecosystem. The site presents the page title “imToken 官网”, indicating a possible attempt to reference the legitimate imToken service, and the campaign is listed under the generic brand target “across”. The domain was registered on July 16, 2025 through Gname.com Pte. Ltd., and its registration date aligns with the observed activity window.

Technical probing shows the domain resolves to the IPv4 address 45.65.45.18, which belongs to AS32708 Root Networks and is geolocated in Hong Kong. Authoritative name servers are a.share-dns.com and b.share-dns.net, both typical of shared DNS services. The site serves content over HTTPS using a Let’s Encrypt certificate (R10), and HTTP requests return a 200 status code, confirming that the host is actively delivering web content.

Detection telemetry indicates that 10 out of 95 security vendors on VirusTotal have flagged the domain, and the domain appears on a single external blocklist. The threat has been added to PhishDestroy’s blocklist, and the Gridinsoft trust score is 0 out of 100, reflecting a strong malicious reputation. These signals collectively suggest that the infrastructure is intentionally crafted to evade casual inspection while remaining reachable for victim interaction.

Defenders should prioritize blocking DNS resolution to 45.65.45.18 and adding imokenu.com to web‑filtering and URL‑allowance policies. Monitoring for traffic to the associated name servers a.share-dns.com and b.share-dns.net can provide early indicators of related campaigns. Given the cryptocurrency focus, organizations handling digital asset wallets should enforce multi‑factor authentication and educate users about unsolicited requests referencing “imToken”. Continued observation of VirusTotal and blocklist updates is recommended to capture any escalation in detection counts.