68uv[.]pilot45[.]com

On July 23, 2026 a technical examination of the domain 68uv.pilot45.com was performed. The site is classified as a brand‑impersonation campaign targeting the cryptocurrency wallet provider imToken, as indicated by the page title "im官网-imtoken安卓版冷钱包下载" and the explicit brand reference in the intelligence. The domain was created on December 23, 2024 and is registered through Gname.com Pte. Ltd. Its authoritative name servers are aron.ns.cloudflare.com and titan.ns.cloudflare.com, pointing to a Cloudflare front‑end. DNS resolution returns the address 104.21.2.72, an IP owned by AS13335 Cloudflare, Inc. located in the United States. No TLS certificate is presented, implying that the service is reachable only over plain HTTP.

VirusTotal reports that fifteen of ninety‑five scanned security vendors flagged the domain, reinforcing the malicious assessment. The domain is currently listed as blocked by the PhishDestroy feed and appears on a single external security blocklist. Reputation services assign a Scamadviser trust score of 1 out of 100, reflecting an extremely low confidence rating. The operational status is recorded as offline, and no live content was captured at the time of analysis.

Uncertainties remain around the specific payload or credential‑harvesting mechanisms, as no page screenshots, script hashes, or additional indicator sets were available. Defensive actions should include immediate network‑level blocking of 68uv.pilot45.com and its resolved IP address, incorporation of the domain into threat‑intel feeds, and monitoring for any re‑registration attempts or related sub‑domains under the same registrar. Continuous observation of Cloudflare‑hosted assets associated with the same ASN is advised, as adversaries frequently recycle infrastructure. Updating intrusion‑detection signatures to flag the observed page title and brand reference can further reduce exposure to this impersonation vector.