rccghopehall[.]com

Analysis of rccghopehall.com indicates that the domain was used for a generic phishing campaign targeting users of the imToken cryptocurrency wallet, as inferred from the page title “imToken官网‑imtoken官方网站中文版”. The domain resolves to the IPv4 address 176.65.139.8, which is registered to an offshore limited company in the Netherlands and is announced by AS214472. The hosting provider is not directly identified, but the address resides within a network commonly leveraged for malicious activity. TLS negotiation is performed with a Let’s Encrypt certificate issued under the “YR1” identifier, which provides only domain validation and does not convey any trust beyond encryption.

The domain was created on 22 December 2013 and is registered through Namecheap Inc, using the authoritative name servers a.share‑dns.com, a12.share‑dns.com, b.share‑dns.net, and b12.share‑dns.net. The site has been taken offline, and the phishing infrastructure has been blocked by the PhishDestroy mitigation service. VirusTotal analysis shows that 9 of 91 antivirus and URL‑reputation scanners flagged the domain, indicating a modest but non‑trivial detection rate. Additionally, the domain appears on a single external blocklist, confirming that at least one security‑vendor feed has catalogued it as malicious.

No further public intelligence, such as Safe Browsing or Open Threat Exchange entries, is available for this indicator. Defenders should continue to block the domain at perimeter and DNS layers, monitor the associated IP address for any resurgence of activity, and add the domain and IP to internal threat‑intel feeds. Because the certificate is publicly trusted, traffic to the site could still have been perceived as legitimate while the site was active; therefore, organizations that previously observed connections to this IP should investigate any related authentication attempts for compromised credentials.