imtoken[.]xn--fiqs8s

imtoken.xn--fiqs8s was registered on 21 February 2026 through the registrar 成都西维数码科技有限公司. The domain is configured with the authoritative nameservers ns1.363.hk and ns2.363.hk and resolves to the IPv4 address 45.205.26.173, which belongs to AS8796 FASTNET DATA INC and is geolocated in the United States. No TLS certificate is presented for the host, indicating that connections are served over plain HTTP only. The page title retrieved during the brief scan is the string “530”, providing no further context about the page’s purpose. VirusTotal analysis shows that seven of ninety‑three antivirus and URL scanning engines flagged the domain as malicious, and Gridinsoft assigned a trust score of zero out of one hundred.

The domain is listed on a single external security blocklist and has been actively blocked by the PhishDestroy service. Intelligence tags the site as a crypto‑related scam that impersonates the brand “celer”, aligning with the broader threat category of brand impersonation. Current operational status is reported as offline, suggesting that the hosting infrastructure has been taken down or is no longer serving content at the time of observation. The available evidence confirms that the infrastructure is deliberately associated with a brand‑impersonation campaign targeting users of the celer brand, likely to harvest cryptocurrency credentials or funds.

However, the lack of a TLS certificate, the minimal page title, and the relatively low number of vendor detections leave open questions about the full scope of the malicious payload and whether additional phishing pages exist under the same IP address. Defenders should add 45.205.26.173 to network‑level deny lists, enforce DNS filtering for imtoken.xn--fiqs8s, and monitor the associated nameservers (ns1.363.hk, ns2.363.hk) for any re‑registration activity.