m[.]happymachine[.]cn

Analysis of m.happymachine.cn, which was taken offline prior to the report date of July 23, 2026, shows multiple indicators of malicious intent. The domain returned HTTP status 200 and served a page whose title reads "imtoken钱包_imtoken下载_imtoken钱包下载链接移动版," explicitly referencing the imtoken cryptocurrency wallet and suggesting a counterfeit download page. The site used a Let's Encrypt certificate (YR1) issued for the domain, which does not provide any assurance of legitimacy and is commonly employed by threat actors to gain user trust. DNS resolution points to the IP address 176.65.139.8, located in the Netherlands and assigned to AS214472 Offshore LC, a hosting provider that is frequently associated with abuse.

The domain’s authoritative nameservers are a4.share-dns.com and b4.share-dns.net, both of which are generic shared DNS services often leveraged for rapid deployment of malicious sites. VirusTotal scans recorded 13 detections out of 91 security vendors, indicating that a notable portion of the security community has identified the domain as malicious. The domain appears on at least one security blocklist and has been actively blocked by the PhishDestroy service, reinforcing the assessment of its phishing nature. Registration data shows the domain was created on March 07, 2024 through Web Commerce Communications Limited, a registrar that has hosted other abusive domains in the past.

While the site is currently offline, the combination of a targeted page title, malicious detections, blocklist listings, and hosting characteristics suggests that the domain was used to lure victims into downloading fraudulent software or disclosing credentials related to the imtoken wallet. Defenders should continue to monitor the IP address 176.65.139.8 for any re‑use, enforce blocklisting of the domain in corporate web filters, and consider adding the associated nameservers to watchlists.