imtoken.surf
Category: Cryptocurrency
- Don't sign in or pay here. Close it. If you typed a password, change it where you normally use it.
- Already visited? Check your device. A free scan shows whether anything was installed.
- Stop the next one. Combo Cleaner's web protection blocks phishing and scam sites before they load.
Combo Cleaner is PCrisk's own anti-malware tool, owned by RCS LT. Free to scan; removing what it finds needs a licence (7-day free trial).
Description of imtoken.surf
The domain imtoken.surf appears to present itself as the website of imToken, a cryptocurrency wallet focused on ETH, BTC, and related blockchain assets. The page title and visible homepage text are in Chinese and promote a digital wallet application, including a download call-to-action and claims about user scale and asset management services.
Based on the branding, layout, and metadata, the site appears to target users seeking a crypto wallet or wallet download page. However, the domain uses the .surf extension rather than a more obviously brand-associated domain, and the content appears to imitate an established cryptocurrency wallet brand rather than operate under a clearly official web address. That raises authenticity concerns about who actually operates the site.
Safety Assessment for imtoken.surf
Multiple security signals indicate elevated risk at the time of this scan. The domain was flagged by 16 out of 93 security engines, with many classifying it as phishing or malicious. In addition, one threat database listing was present, and the domain's IP address was listed on one mail-reputation blocklist. While a separate malware scan reported no directly flagged files, it did attach a generic malicious label to the domain and numerous linked resources, which adds to the overall caution rather than offsetting the broader phishing detections.
The site also appears to mimic the branding of a known cryptocurrency wallet while using a different domain name, which may indicate a look-alike or impersonation setup intended to attract users searching for that wallet. This concern is strengthened by the domain's very recent registration age of 54 days, lack of established traffic ranking, and the presence of a download-oriented landing page in a high-risk category for credential theft or wallet compromise.
Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site was reachable over HTTPS with a valid Let's Encrypt certificate expiring on 2026-11-18. It appears to be served by nginx from IP address 186.240.200.15, hosted by Iens Technology Pte. LTD in Singapore. DNSSEC is not enabled, and the domain uses ns1.domainnamens.com and ns2.domainnamens.com as nameservers.
From a technical risk perspective, the domain is very new, DNSSEC is unsigned, and scan data shows numerous internally hosted resources that were generically flagged during analysis. The combination of recent registration, cryptocurrency-themed branding, and phishing detections across multiple security engines is a more significant concern than the presence of TLS alone.
Share your experience with this website. Was it safe? Did you encounter any issues?