imtokeniks[.]com

Analysis of imtokeniks.com shows multiple indicators of malicious activity. The domain was registered on September 03, 2025 through Gname.com Pte. Ltd. and resolves to the Cloudflare IP address 188.114.97.3 (AS13335, United States). The hosting infrastructure uses Nginx with HTTP/3 support and enforces HSTS, while the TLS certificate is issued by Let’s Encrypt (R12). The site title returned by the server is the Chinese phrase "网站筹建中," which translates to "website under construction," but no further content has been observed because the domain is currently offline.

Threat intelligence flags the domain as a crypto‑related scam; it appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal scans have recorded 17 detections out of 95 security vendors, and AlienVault OTX lists the domain in 16 separate threat pulses. Additionally, Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high risk assessment.

While the offline status limits real‑time verification of payloads or phishing pages, the convergence of vendor detections, blocklist listings, low trust score, and the explicit crypto scam classification provides strong evidence of malicious intent. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of activity, and add the associated IP and nameservers (aron.ns.cloudflare.com, titan.ns.cloudflare.com) to watchlists. Ongoing surveillance of related Cloudflare‑hosted assets is advised, as threat actors may shift to new subdomains or IPs under the same infrastructure.