tokenpockot[.]com[.]cn

PhishDestroy identifies tokenpockot.com.cn as an active brand impersonation domain targeting OKX users. The site mimics legitimate crypto wallet services, specifically TP钱包/TokenPocket, to trick visitors into downloading malicious software under the guise of an official wallet. The domain’s homepage promotes a fake download page titled 'TP钱包下载,' which is a common tactic used by crypto drainers to steal private keys or funds. This domain was flagged due to its clear intent to impersonate a trusted crypto brand. Investigation reveals it was registered on March 25, 2026, through Dynadot Inc, a domain registrar often exploited by threat actors for short-lived malicious campaigns. Despite its recent creation, the domain already hosts a Let’s Encrypt SSL certificate, which adds false legitimacy to its fraudulent activities. VirusTotal currently shows 0 detections out of 95 scans, indicating it may be newly operational or actively evading detection mechanisms. If you visited tokenpockot.com.cn, disconnect from the internet immediately and scan your device for malware. Do not enter any credentials or download software from the site. Report the domain to OKX’s official fraud reporting channels and block the IP address 154.206.155.118 on your network. Always verify cryptocurrency-related downloads by cross-referencing with official sources and using hardware wallets for added security.