imtoknn[.]icu

This analysis identifies imtoknn.icu as an elevated-risk domain associated with generic phishing activity, specifically aligned with fake login credential harvesting and potential brand impersonation tactics. The domain is currently reported as offline, but historical infrastructure signals indicate malicious intent prior to takedown.

Technical intelligence shows the domain resolves to IP 154.194.170.66 hosted in Hong Kong under AS139880 OWGELS INTERNATIONAL CO., LIMITED. It is registered via Gname.com Pte. Ltd. and was created on September 26, 2025. Security telemetry indicates SSL certificate is unknown. It appears on two security blocklists and is blocked by PhishDestroy and PhishingDB. VirusTotal reports 19/95 security vendors flagging the domain as malicious, indicating strong cross-vendor detection consensus. The page title observed is 404 Not Found, consistent with takedown or sinkhole behavior rather than active benign hosting.

Mitigation analysis recommends blocking the domain at DNS and network perimeter layers and maintaining IP-level filtering for 154.194.170.66. Users should be warned against credential submission attempts originating from any residual redirects or cached links. Given the fake login phishing profile, monitoring for lookalike domains and certificate-less HTTPS impersonation attempts is advised. Threat intelligence feeds should be updated to retain historical indicators for retrospective detection and incident response correlation.