imtoken[.]living

This domain is flagged as a high-risk instance of crypto wallet impersonation, specifically designed to mimic legitimate cryptocurrency wallet services while targeting users of the Google brand. The infrastructure is engineered to deceive victims into interacting with fraudulent wallet interfaces, likely leading to unauthorized asset transfers or credential harvesting. Analysis indicates this is not a generic phishing attempt but a specialized crypto drainer operation, given the explicit focus on wallet downloads and cryptocurrency-related terminology in the page title. Infrastructure analysis reveals the domain imtoken.living was registered on February 03, 2025, through Dynadot LLC and currently resolves to the IP address 43.134.218.37, hosted in Hong Kong under AS132203 (Tencent Building, Kejizhongyi Avenue). The domain lacks an SSL certificate, increasing the risk of interception or manipulation of user data. Security vendor detections on VirusTotal report 14 out of 95 engines flagging the domain as malicious. The domain appears on two independent security blocklists, including PhishDestroy and PhishingDB, further corroborating its malicious classification. The page title, "imtoken - imToken-钱包下载 | 以太坊和比特币钱包," explicitly references cryptocurrency wallet downloads, aligning with tactics used in crypto drainer schemes. Mitigation for this threat type requires immediate action from security teams and end users. Network-level blocking of the domain and its resolving IP (43.134.218.37) is recommended to prevent access. Organizations should update web filtering rules to categorize imtoken.living as a malicious or phishing domain. Users who may have interacted with the site should be instructed to revoke any wallet permissions granted, transfer assets to new wallets, and scan devices for malware. Given the absence of SSL, any data transmitted to this domain should be considered compromised. Security teams are advised to monitor for related infrastructure, particularly domains registered through the same registrar (Dynadot LLC) or resolving to the same IP range, as these may indicate additional malicious activity.