imtoken[.]ng

This domain, imtoken.ng, poses a direct financial threat by impersonating the legitimate imToken cryptocurrency wallet. The site displays a fraudulent interface designed to trick users into entering sensitive credentials, including private keys and recovery phrases. Once obtained, these credentials allow attackers to drain cryptocurrency assets from victims' wallets, particularly targeting users of the Cosmos ecosystem. The threat is immediate and severe, as stolen credentials provide unrestricted access to digital assets without possibility of recovery. Analysis indicates this domain was registered on February 21, 2026, through Dynadot Inc, an unusual future date suggesting potential domain spoofing or registry manipulation. The site is flagged by 18 out of 95 security vendors on VirusTotal, with additional detections by PhishDestroy and ScamSniffer. Infrastructure analysis reveals the domain resolves to 188.114.96.3, hosted on Cloudflare's network (AS13335), and presents a valid SSL certificate issued by Google Trust Services. These technical indicators, combined with its presence on two security blocklists, confirm the domain's malicious intent and elevated risk level. If you have visited imtoken.ng or entered any sensitive information, immediate action is required. First, transfer all remaining assets from the compromised wallet to a new, secure wallet using a different device. Do not reuse any credentials or recovery phrases associated with the fraudulent site. Next, monitor all connected accounts for unauthorized transactions and enable additional security measures such as multi-factor authentication where available. Finally, report the incident to relevant blockchain security teams and consider filing a report with local cybercrime authorities to aid in tracking the fraudulent operation.