imtoken-gf[.]org[.]cn

On 23 July 2026 the domain imtoken-gf.org.cn was observed hosting a webpage with the title “imToken官网 - Web3数字资产钱包 | 安全便捷的加密资产管理”. The site is registered through 成都西维数码科技有限公司 and was created on 21 February 2026. DNS resolution points to the IPv4 address 38.6.207.71, which belongs to ASN 398823 (PEG TECH INC) and is geolocated in the United States. The server presents a Let’s Encrypt certificate (R13) and responds with HTTP 200 over an Nginx stack behind Cloudflare, employing HTTP/3, HSTS, and loading assets from cdnjs. VirusTotal reports that 13 of 93 scanned security vendors flag the domain, indicating a moderate level of detection across the industry.

The domain currently appears on three public blocklists – PhishDestroy, MetaMask, and SEAL – and is listed as a crypto‑related scam in the intelligence feed. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The domain is classified as a high‑risk, active generic phishing operation targeting cryptocurrency users, specifically leveraging the imToken brand name in the page title to lure victims. The evidence does not include a detailed content analysis of the page beyond the title, nor any observed credential‑stealing forms, so the exact phishing workflow remains unconfirmed.

Defenders should block the domain at the network perimeter, add the IP address 38.6.207.71 to deny lists, and ensure that endpoint protection solutions reference the current VirusTotal detection count. Monitoring of the associated nameservers (ns1.363.hk, ns2.363.hk, ns1.myhostadmin.net, ns2.myhostadmin.net) for future changes is advised, as well as periodic re‑scans to capture any evolution of the payload. Users of the imToken wallet should be warned against visiting the domain and instructed to verify URLs through official channels. Continued observation is recommended to capture any subsequent infrastructure shifts.