m[.]biblesignals[.]com

This domain m.biblesignals.com is currently active and serves a fraudulent page whose title references “imtoken_imtoken官网下载_imtoken官网地址”, suggesting an attempt to lure victims into downloading a counterfeit version of the imToken wallet. The site resolves to the IPv4 address 176.65.139.8, which is hosted in the Netherlands and belongs to AS214472 Offshore LC. The server presents a Let’s Encrypt certificate (issuer YR1) and runs Nginx with jQuery, HSTS and HTTP/3 enabled. DNS is provided by a3.share-dns.com and b3.share-dns.net, both typical of Namecheap‑registered domains. The domain was created on 24 December 2020 and now returns an HTTP 301 redirect, indicating possible content relocation or cloaking. Threat intelligence flags the domain on at least one public blocklist (PhishDestroy) and 20 of 91 VirusTotal scanners have reported it as malicious. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The evidence confirms a high‑risk phishing operation targeting imToken users, but the exact payload, phishing page layout, and credential‑capture mechanisms have not been observed directly. Defenders should block the domain and its underlying IP at perimeter defenses, monitor DNS queries for the associated nameservers, and add the URL to URL filtering policies. Incident response teams should also consider hunting for any successful imToken credential compromises that may have originated from this host, and update threat‑intel feeds with the observed indicators of compromise.