imtoken-wallet[.]club

Analysis of the domain imtoken-wallet.club indicates that it is being used as a high‑risk crypto‑drainer infrastructure. The domain resolves to the IP address 97.74.95.60 and is hosted on name servers ns57.domaincontrol.com and ns58.domaincontrol.com, both of which are typical of generic registrar services. VirusTotal records show that four of ninety‑one security vendors have flagged the domain, confirming that it has attracted some level of detection, although the majority of scanners have not yet flagged it.

The domain is currently listed on two external security blocklists and has been actively blocked by the PhishDestroy and SEAL mitigation services, suggesting that defensive communities have observed malicious activity originating from this host. The threat type is identified as a crypto drainer, meaning the infrastructure is likely intended to lure victims into transferring cryptocurrency to attacker‑controlled wallets. No additional public evidence such as page titles, SSL certificate details, or HTTP response codes is available at this time, leaving the exact content and user‑experience of the site unverified.

Defenders should continue to enforce blocklist rules that include imtoken-wallet.club, monitor outbound connections to its resolved IP, and consider adding the domain to internal deny lists. Network traffic analytics should flag any attempts to resolve or contact the domain, and endpoint protection should be configured to alert on the four vendor detections reported by VirusTotal. Ongoing observation is advised, as the domain remains active and could evolve its tactics.