imtokni[.]com[.]cn

This domain is flagged for hosting a crypto wallet drainer targeting users of the legitimate imToken platform. Analysis indicates the site impersonates the official imToken wallet interface, likely designed to trick victims into connecting wallets and authorizing malicious transactions that siphon digital assets. The threat type is classified as a crypto drainer, a specialized form of credential and asset theft targeting cryptocurrency holders, with an elevated risk level due to its direct financial impact. Infrastructure analysis reveals the domain imtokni.com.cn was registered through Dynadot Inc on May 24, 2026, an anomalous future date suggesting potential registration data manipulation. The domain resolves to the IP address 154.206.139.79 and uses a Let's Encrypt SSL certificate (R13). Detection metrics show 19 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on one additional security blocklist and is actively blocked by PhishDestroy. The page title, 'imToken官网｜安全可信的数字钱包 - 多链资产管理,' directly mimics the branding of the legitimate imToken wallet, reinforcing the impersonation scheme. Mitigation against this crypto drainer threat requires immediate user education and technical controls. Digital asset holders should verify domain authenticity before connecting wallets, ensuring they only interact with the official imToken domain (token.im). Wallet software should be configured to require explicit transaction approvals, and users should avoid granting broad permissions to unfamiliar sites. Organizations managing cryptocurrency infrastructure should implement domain monitoring for lookalike registrations and deploy network-level blocks for known malicious IPs, such as 154.206.139.79, to prevent access to confirmed drainer sites.