imtokm[.]app

Analysis shows that imtokm.app is an active crypto‑focused impersonation campaign targeting the Cosmos brand. The domain was registered on November 24, 2025 through Dynadot LLC and resolves to IP address 38.60.168.93, which is assigned to Kaopu Cloud HK Limited in Malaysia (AS138915). No SSL certificate is present, and the site currently returns an offline HTTP status, indicating that the malicious payload is not presently being served but the infrastructure remains in place. The page title returned by the server is "imToken | Ethereum & Bitcoin Wallet," suggesting the threat actor is leveraging a reputable wallet name to lure cryptocurrency users.

The campaign is classified as a crypto scam in the intelligence feed. Detection data shows that 19 of 95 security vendors on VirusTotal have flagged the domain, and the domain appears on four independent security blocklists. It has also been identified in sixteen AlienVault OTX pulses, reinforcing its reputation as a repeat offender.

Blocklist operators PhishDestroy, Polkadot, Enkrypt, and Codeesura have already taken action to block the domain, and Gridinsoft assigns it a trust score of 0 out of 100, reflecting a high confidence of malicious intent. Defenders should prioritize adding imtokm.app and its resolving IP 38.60.168.93 to network deny lists, enforce TLS inspection to catch any future activation of the site, and monitor for new domains that use similar naming patterns or reference the Cosmos brand. Continuous threat‑intel feeds should be consulted for any resurgence, and endpoint protection policies should be tuned to flag the page title "imToken | Ethereum & Bitcoin Wallet" as a potential indicator of compromise.