token-im-zh[.]com

This domain is flagged as a high-risk crypto scam site actively hosting phishing infrastructure. Registered on October 13, 2025, through Dominet (HK) Limited, the domain resolves to IP 172.66.151.95, which is hosted by Cloudflare (AS13335) in the United States. The page title observed is 'Nur einen Moment…', a common placeholder used by phishing kits during redirection or loading phases. The domain uses nameservers ns1.domainnamedns.com through ns4.domainnamedns.com and employs an Nginx web server with HSTS enabled. An SSL certificate issued by Let's Encrypt (R12) is in place. VirusTotal analysis shows 4 out of 95 security vendors flagging this domain as malicious, and it appears on one security blocklist (PhishDestroy). The Gridinsoft trust score is 0/100, indicating strong evidence of fraudulent intent. Infrastructure analysis reveals a 301 HTTP redirect, suggesting the site may redirect visitors to a secondary phishing page or credential harvesting form. The exact content of the landing page has not been visually analyzed, but the combination of a crypto scam classification, low trust score, and active blocklist presence confirms this domain is part of a phishing campaign. Defenders should block the domain at the DNS or proxy level, monitor for related subdomains or IPs under the same Cloudflare ASN, and report the domain to Dominet (HK) Limited for takedown. Users who have interacted with this site should be advised to revoke any credentials or crypto wallet permissions shared.