anzaz[.]tkshopskaidian[.]com

The domain anzaz.tkshopskaidian.com is identified as a high-risk brand impersonation threat targeting the Compound brand. The page title found on this domain, 'imToken 官网｜以太坊和比特币区块链钱包', suggests that the threat actor is attempting to masquerade as a legitimate cryptocurrency wallet service to deceive users and potentially steal their credentials or funds.

Analysis indicates that the domain has a VirusTotal detection score of 19/95, suggesting that a significant number of security vendors recognize it as malicious. The domain is registered through July Name Limited and resolves to the IP address 156.238.245.212, which is located in Hong Kong (HK) and belongs to AS137899 I LAYER LIMITED. The domain was created on August 30, 2025, and has been flagged by Google Safe Browsing as a phishing site. Additionally, the domain appears on one security blocklist and is currently blocked by PhishDestroy.

The current status of the domain is offline, indicating that the threat has been neutralized. However, the infrastructure used for this threat, including the IP address and registrar, should be monitored for any future malicious activities. Despite the domain being taken offline, users who may have interacted with it before it was shut down are advised to change their passwords and monitor their accounts for any unauthorized activity. The remaining risk is low, but vigilance is recommended.