token-im-web[.]com

This domain, token-im-web.com, is flagged as a high-risk generic phishing domain primarily associated with a crypto scam. The domain was created on October 13, 2025, and is currently active. It is registered through Dominet (HK) Limited and resolves to the IP address 172.66.151.95, located in the United States under the AS13335 Cloudflare, Inc. network. The HTTP status code 301 indicates a permanent redirect, which is often used to lure victims to a different, potentially malicious site. The domain uses Nginx as its web server and has an HSTS policy, which can be a tactic to maintain trust and prevent users from accessing the site over HTTP. The SSL certificate is issued by Let's Encrypt, which is common for both legitimate and malicious sites. Analysis indicates that the domain appears in 23 threat intelligence pulses on AlienVault OTX and has a Gridinsoft trust score of 0/100, reflecting a high level of suspicion. The domain is also listed on one security blocklist and is blocked by PhishDestroy. While the exact content of the site is not yet analyzed, the page title 'Just a moment...' suggests a potential delay or interstitial page often used in phishing attacks. Defenders should block this domain and monitor for any related malicious activity. Given the high risk level, additional scrutiny and proactive measures are recommended to protect users from potential financial losses.