m[.]redhencrafts[.]com

This domain, m.redhencrafts.com, is actively impersonating the imToken cryptocurrency wallet platform to deceive users into entering sensitive credentials or recovery phrases. The site poses as an official imToken download portal, as indicated by its page title, which includes the phrases 'imtoken官网' and 'imtoken安卓.' Victims who interact with this site risk having their wallet credentials stolen, leading to unauthorized access and potential theft of digital assets. The fraudulent nature of the site is further supported by its use of a generic Let's Encrypt SSL certificate, which provides a false sense of security to unsuspecting users. Analysis indicates that m.redhencrafts.com has been flagged by 14 out of 95 security vendors on VirusTotal, a clear indicator of its malicious intent. The domain was registered on December 26, 2005, through NAMECHEAP INC, though its infrastructure has been repurposed for phishing activity. Despite its long registration history, the domain currently resolves to the IP address 178.236.38.2 and remains active, as confirmed by its presence on one security blocklist. The use of a subdomain (m.redhencrafts.com) suggests an attempt to evade detection or leverage a compromised legitimate domain for malicious purposes. Users who have visited m.redhencrafts.com or entered any information on the site should immediately cease all interaction and take corrective action. First, disconnect any devices used to access the site from the internet to prevent further data exfiltration. Next, assume that any credentials or recovery phrases entered have been compromised and transfer all digital assets to a new, secure wallet. Enable multi-factor authentication on all accounts and monitor for unauthorized transactions. Finally, report the incident to relevant security teams or platforms to help mitigate further risks to the broader community.