imtokendefi-cn[.]com

This domain, imtokendefi-cn.com, is flagged as an active crypto drainer phishing site targeting users through brand impersonation. Registered on March 23, 2026, via TuringSign Inc. d/b/a Cosmotown, the domain resolves to IP address 201.5.252.195, hosted in Hong Kong. Infrastructure analysis reveals the use of four nameservers (ns1.domainnamedns.com through ns4.domainnamedns.com) and an SSL certificate issued by TrustAsia Technologies, Inc. under the LiteSSL RSA CA 2025 hierarchy. The site returns an HTTP 200 status, indicating active hosting, and is classified as an airdrop scam phishing kit. Security vendor detection on VirusTotal shows 19 of 91 engines flagging the domain as malicious, though the specific nature of detections (e.g., phishing, malware, or crypto-related threats) is not detailed. The domain appears on at least one security blocklist and has been blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, further corroborating its high-risk classification. Defenders should treat this domain as a confirmed crypto drainer threat. Recommended actions include immediate blocking at the DNS and network perimeter levels, monitoring for connections to the associated IP (201.5.252.195), and reviewing logs for any prior interactions. The use of airdrop-themed phishing kits suggests the site may lure victims with fraudulent token giveaways, leading to wallet-draining attacks. No legitimate association with the impersonated brand or service is known. Further analysis of the phishing kit or hosted content is pending, but current indicators warrant proactive mitigation.