tokcnpocket[.]pro

The domain tokcnpocket.pro was registered on February 21, 2026 through Dynadot LLC and is currently taken offline. DNS resolution points to the IPv4 address 199.191.50.229, which belongs to Confluence Networks Inc (AS40034) and is geolocated in the United States. The authoritative nameservers are 5014.ns1.abovedomains.com and 5014.ns2.abovedomains.com, indicating use of the Abovedomains DNS service. An active TLS certificate issued by Let’s Encrypt (R13) was observed, confirming that the site served HTTPS traffic before being disabled.

Web technology fingerprints show a PHP backend running on Apache HTTP Server, with client‑side libraries including jQuery, jQuery UI, Google Tag Manager and Contentsquare, suggesting a typical content‑delivery stack often employed by phishing kits. The page title returned during the brief live period was “Mamma.com Search – Trust Mamma to provide the best search results,” which does not correspond to the hosting domain and may have been intended to lure users. Reputation data indicates the domain appears on one security blocklist and received a Gridinsoft trust score of 0 out of 100. VirusTotal analysis recorded 15 detections out of 93 scanning engines, and the domain is listed as blocked by PhishDestroy.

These indicators collectively confirm that tokcnpocket.pro was used for credential harvesting or related phishing activity. Uncertainty remains regarding the specific payload, victim targeting, and whether additional infrastructure shares the same IP or DNS configuration. Defensive recommendations include adding the domain and its IP address 199.191.50.229 to blocklists, monitoring DNS queries for the associated nameservers, and enforcing TLS inspection to detect any future re‑use of the certificate. Organizations should also update web filtering rules to flag the page title and associated technology stack, and continue to monitor threat‑intelligence feeds for any resurgence of the infrastructure.