imteyon[.]im

PhishDestroy first observed imteyon.im on Sep 6, 2025. Stored content metadata identifies Compound as the apparent target. The captured page title is “imToken 官网｜以太坊和比特币区块链｜imtoken钱包”. Page analysis recorded additional brand references to Cosmos. Stored page analysis classifies the content as brand impersonation. Current evidence score: 95/100 (critical).

Positive findings are stored from 4 sources: VirusTotal, Google Safe Browsing, URLQuery, and URLScan. VirusTotal recorded 16 detections among 95 engines: alphaMountain.ai, BitDefender, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Google Safebrowsing, Kaspersky, Lionic, Phishing Database, Seclookup, SOCRadar, Sophos, VIPRE, Webroot on Feb 23, 2026 at 05:29 UTC. Google Safe Browsing flagged the domain: Social Engineering on Feb 25, 2026 at 20:32 UTC. URLQuery recorded 100 detections; no observation timestamp was retained. URLScan returned a malicious verdict with score 100; scan metadata linked the capture to Imtoken and assigned phishing as its category on Jul 29, 2026 at 03:41 UTC. Non-positive and contextual checks: AlienVault OTX listed 17 community pulse references (not vendor detections) on Mar 1, 2026 at 23:41 UTC. The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 02:20 UTC. PhishStats returned no feed match on Mar 2, 2026 at 18:06 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:17 UTC; content was unavailable. The recorded creation date for the domain is May 6, 2025. At collection time, the hostname resolved to 156.227.73.50 on AS139880 (OWGELS-AS-AP OWGELS INTERNATIONAL CO., LIMITED, HK). The IP and ASN identify shared CDN edge infrastructure; the origin server is not established by this address. The stored server header is nginx. DOM analysis on Apr 23, 2026 at 23:20 UTC returned 10/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan.

The content indicators and 4 positive source findings support the current Compound-themed brand impersonation classification.