imtoknm[.]com[.]cn

This domain, imtoknm.com.cn, has been assessed at an elevated risk level due to its classification as a crypto drainer phishing threat. Such sites are designed to trick users into connecting their cryptocurrency wallets, allowing attackers to drain funds through malicious smart contracts or fake transaction requests. The domain is now offline, but its infrastructure remains a concern for potential re-emergence.

The security analysis reveals significant red flags: VirusTotal data shows 19 out of 95 security vendors flagging the domain as malicious, indicating widespread detection across the cybersecurity community. The domain was registered through Dynadot Inc on May 24, 2026, a relatively recent date that aligns with typical phishing lifecycle patterns. It resolves to IP address 154.206.128.239 and uses an SSL certificate from Let's Encrypt (R13), which is commonly abused by threat actors due to its free and automated issuance. Furthermore, imtoknm.com.cn appears on at least one security blocklist, underscoring its malicious reputation.

Users are strongly advised to never interact with this domain or any similar-looking URLs. For crypto drainer threats, the primary mitigation is to avoid connecting any cryptocurrency wallet to unfamiliar sites, especially those requesting approval of smart contracts or signing transactions. Always verify URLs by checking official sources and enable two-factor authentication on crypto accounts. If any wallet connection was made, immediately revoke permissions via a blockchain explorer and transfer assets to a new wallet. Report the domain to anti-phishing organizations and monitor accounts for unauthorized activity.