zdsyt[.]com

The domain zdsyt.com is identified as a high-risk phishing site specifically targeting users of the imToken cryptocurrency wallet. Analysis confirms this domain impersonates the official imToken platform, presenting itself as a source for wallet application downloads. The page title explicitly references "imtoken钱包官网app下载" and promotes a purported 2025 version, indicating an attempt to deceive users into downloading malicious software under the guise of legitimate wallet updates. Current status indicates the domain has been taken offline, though prior infrastructure remains a documented threat. Infrastructure analysis reveals the domain was registered on February 28, 2013, through West263 International Limited. It resolves to the IP address 43.169.25.95 and has been flagged by 13 of 95 security vendors on VirusTotal. Detection systems including MetaMask, PhishDestroy, and SEAL have blocked this domain, contributing to its presence on three security blocklists. The trust score from Gridinsoft is 0 out of 100, further corroborating its malicious classification. Technologies detected on the site include Bootstrap, Nginx, Slick, jQuery, HSTS, and HTTP/3, which are consistent with modern phishing frameworks designed to mimic legitimate services. As of the latest assessment, zdsyt.com has been rendered inaccessible, though residual risks persist for users who may have interacted with the domain prior to its takedown. Security teams are advised to monitor network logs for connections to 43.169.25.95 and review endpoint devices for unauthorized cryptocurrency wallet applications. Organizations should update blocklists to include this domain and its associated IP, while users should verify all wallet downloads exclusively through official vendor channels. Continuous vigilance is recommended, as phishing infrastructure often re-emerges under altered domains or IP configurations.