imtoken-wallet[.]store

The domain imtoken-wallet.store is currently listed as an active crypto drainer. Infrastructure analysis shows that the A record resolves to the IPv4 address 3.33.130.190. The authoritative name servers are ns57.domaincontrol.com and ns58.domaincontrol.com, both belonging to the registrar’s default pool. The domain appears on two independent security blocklists and is explicitly blocked by the PhishDestroy and SEAL filtering services, indicating that multiple threat‑intelligence feeds have observed malicious activity associated with this host.

VirusTotal reports that the domain has been submitted to 91 scanning engines; none of the engines raised a detection at the time of the last scan, but the absence of a flag does not constitute a safety guarantee. No public SSL certificate details, HTTP status codes, or page‑title information have been disclosed in the available intelligence, so the surface‑level behavior of the web service remains unverified. The threat classification supplied is “crypto drainer,” suggesting that the site is likely employed to solicit cryptocurrency credentials or private keys and subsequently exfiltrate them.

Defenders should treat the domain as hostile: network perimeter devices should deny outbound connections to the resolved IP, DNS resolvers should enforce blocklist rules that include the domain, and endpoint monitoring should alert on any process attempting to communicate with 3.33.130.190. Continuous re‑evaluation is advised because the domain’s status is listed as “under investigation” and could change if additional detections emerge. Logging of DNS queries for this FQDN and correlation with authentication attempts to cryptocurrency wallets will aid in early detection of compromise attempts.