# PhishDestroy domain threat record: tokenpotcet.pro

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/tokenpotcet.pro/
Machine-readable companion: https://phishdestroy.io/domain/tokenpotcet.pro/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-24 00:15:15 UTC
- Last availability or vendor check: 2026-10-24 10:56:46 UTC
- Stored record updated: 2026-10-24 22:24:41 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: TokenPocket

## Stored infrastructure

- Observed IP address: 104.21.85.36
- Registrar in stored WHOIS data: GNAME.COM PTE. LTD.
- Last stored HTTP status: 200
- Registration date (registry RDAP, tokenpotcet.pro): 2026-10-18 08:41:53 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16b41-5072-7409-a90c-de384b752709/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/tokenpotcet.pro
- Certificate Transparency search: https://crt.sh/?q=%25.tokenpotcet.pro
- Web Archive lookup: https://web.archive.org/web/*/https://tokenpotcet.pro/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake system automatically listed tokenpotcet.pro on 2026-10-24 after VirusTotal returned a single malicious detection for a domain only five days old. The prior assessment noted that the page title advertises a TokenPocket wallet and that the domain name closely resembles the legitimate TokenPocket brand, indicating possible brand impersonation. When first fetched on 2026-10-24 the site responded with HTTP 200 and displayed the recorded title “TokenPocket钱包｜安全的数字货币钱包与多链数字钱包下载”.

How the scam works
In wallet‑phishing attacks, actors register look‑alike domains and host pages that claim to be the official wallet, urging users to download an application or enter credentials. The counterfeit app can capture private keys or login details, allowing attackers to steal funds or drain the victim’s wallet.

Evidence
VirusTotal scanned the domain on 2026-10-23 and recorded one malicious detection out of 92 engines, with CRDF labeling it malicious. Google Safe Browsing checked on 2026-10-24 and did not flag the site, while OTX listed one pulse referencing the domain on the same day. urlscan.io captured the page on 2026-10-24; its machine‑learning engine gave a malicious score of 92 and tagged it as phishing, though its overall verdict was non‑malicious, and Cloudflare Radar also marked the URL as malicious phishing. PhishDestroy’s internal blocklist contains the domain, whereas external blocklists returned zero hits on 2026-10-24.

Infrastructure
The domain was registered with GNAME.COM PTE. LTD. on 2026-10-18 and is hosted behind Cloudflare, resolving to IP 104.21.85.36 and 172.67.201.227, both associated with Canada. TLS was issued by Let’s Encrypt on 2026-10-18 (valid until 2027-01-16) and DNSSEC was not enabled; open ports observed were 80, 443 and 8080.

What to do
Users should avoid downloading any wallet from this site and never submit private keys or passwords. If credentials were entered, change the associated passwords immediately. Organizations should add tokenpotcet.pro to web‑filtering and intrusion‑detection rules, monitor DNS queries for the recorded IPs, and review access logs for connections on ports 80 or 443.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16b41-5072-7409-a90c-de384b752709/
Cloudflare Radar report: https://radar.cloudflare.com/scan/1aae90df-18ab-49a2-8ab7-4095e657dc6a
URLQuery report: https://urlquery.net/report/17e5acf4-0f20-409e-b68b-170d586419ff
Stored capture screenshot: https://i.ibb.co/x839gP44/c29d877eea71.png
Cloudflare Radar screenshot (2026-10-24T00:47:11Z): https://screenshots.phishdestroy.io/cf/1aae90df-18ab-49a2-8ab7-4095e657dc6a.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/17e5acf4-0f20-409e-b68b-170d586419ff.png
VirusTotal report: https://www.virustotal.com/gui/domain/tokenpotcet.pro
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=tokenpotcet.pro
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-24 00:48:09 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/x839gP44/c29d877eea71.png
  Captured: 2026-10-24 00:15:15 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a16b41-5072-7409-a90c-de384b752709.png
  Captured: 2026-10-24 00:15:15 UTC
  Source report: https://urlscan.io/result/01a16b41-5072-7409-a90c-de384b752709/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1aae90df-18ab-49a2-8ab7-4095e657dc6a.png
  Captured: 2026-10-24 00:47:11 UTC
  Source report: https://radar.cloudflare.com/scan/1aae90df-18ab-49a2-8ab7-4095e657dc6a
  SHA-256: 5d0ee3972b3867662aa6689a3e50be978f153ba751349b992032f241f424e2a5
- URLQuery: https://screenshots.phishdestroy.io/uq/17e5acf4-0f20-409e-b68b-170d586419ff.png
  Source report: https://urlquery.net/report/17e5acf4-0f20-409e-b68b-170d586419ff
  SHA-256: a0fbe6aa9c04511ec6260a6c787909c180ba49b940c5626fe13454b6d4f15cd9

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-24T00:47:26Z",
        "uuid": "01a16b41-5072-7409-a90c-de384b752709",
        "scanned_at": "2026-10-24T00:13:31Z",
        "final_url": "https://tokenpotcet.pro/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://tokenpotcet.pro/",
                "from": "http://tokenpotcet.pro/",
                "status": 307
            }
        ],
        "ip": "172.67.201.227",
        "domains": [
            "fonts.gstatic.com",
            "images.unsplash.com",
            "api.coingecko.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "151.101.194.208",
            "172.66.172.219",
            "142.251.20.94",
            "142.250.154.95",
            "172.67.201.227"
        ],
        "asns": [
            "54113",
            "13335",
            "15169"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "12a8711c6c0fdd5d87cfb16015712c57dc7c80288b2a371238a848d97660fd61",
        "script_hashes": [
            "5b0e1cc77b271da431062782a418b338b3548b38f41981d98378052985c2c395",
            "d9086c5f9ce19fd109508875814e8c8c79eb3d9966d2cf3c1901206c68b659d6"
        ],
        "globals": [
            "ZB_DOWNLOAD_LINKS"
        ],
        "tls": {
            "san": [
                "*.tokenpotcet.pro",
                "tokenpotcet.pro"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "tokenpotcet.pro",
            "protocol": "QUIC",
            "valid_to": "2027-01-16T07:57:53Z",
            "valid_from": "2026-10-18T07:57:54Z"
        },
        "domain_age_days": 5,
        "apex_age_days": 5,
        "tls_age_days": 5,
        "tls_valid_days": 89,
        "requests": 27,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 92,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-24T00:47:31Z",
        "uuid": "1aae90df-18ab-49a2-8ab7-4095e657dc6a",
        "scanned_at": "2026-10-24T00:47:11Z",
        "final_url": "https://tokenpotcet.pro/",
        "status": 200,
        "history": [
            {
                "url": "https://tokenpotcet.pro/",
                "status": 200
            }
        ],
        "dom_hash": "741139ddf95c26d457a67b071d312da1301d9a3d4d77f27657bafe16753f5c0a",
        "doc_hash": "767c43b15a303e06d99ff8a6404bfe03b286496af289dafa48d26e702776ad15",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains",
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "tokenpotcet.pro",
                "type": "A",
                "value": "172.67.201.227"
            },
            {
                "name": "tokenpotcet.pro",
                "type": "A",
                "value": "104.21.85.36"
            },
            {
                "name": "tokenpotcet.pro",
                "type": "AAAA",
                "value": "2606:4700:3033::6815:5524"
            },
            {
                "name": "tokenpotcet.pro",
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:c9e3"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.201.227",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "GNAME.COM PTE. LTD.",
            "created": "2026-10-18T08:41:53Z",
            "updated": "2026-10-23T08:42:20Z",
            "expires": "2027-10-18T08:41:53Z",
            "nameservers": [
                "logan.ns.cloudflare.com",
                "colette.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-24T00:47:05Z",
        "analysis_at": "2026-10-23T15:59:46Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 1,
            "suspicious": 0,
            "undetected": 37
        },
        "detections": {
            "CRDF": "malicious"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "phishing and fraud",
            "Webroot": "Phishing and Other Frauds",
            "Forcepoint ThreatSeeker": "newly registered websites"
        },
        "first_seen": "2026-10-18T09:02:30Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "colette.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "logan.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::6815:5524"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.201.227"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.85.36"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:c9e3"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "colette.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-23T17:33:28Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.tokenpotcet.pro",
                "tokenpotcet.pro"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6bf4ed07f8cb4a37a175005544c94763cd5",
            "sha256": "6f65ff3b3e6f092c6dcbdb0c4afc8a1b30591b9ca823369c746c70a7f3832a29",
            "subject": "tokenpotcet.pro",
            "valid_to": "2027-01-16T07:57:53Z",
            "valid_from": "2026-10-18T07:57:54Z"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-18T08:41:53Z",
                "registration": "2026-10-18T08:41:53Z",
                "last update of RDAP database": "2026-10-18T08:43:52Z"
            },
            "registrar": "Gname.com Pte. Ltd.",
            "registrar_iana_id": "1923"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-24T00:47:45Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "tokenpotcet.pro"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-24T00:17:17Z",
            "first": "2026-10-24T00:17:17Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 7964
        },
        "social_tags": {
            "ogType": "website",
            "ogTitle": "TokenPocket钱包｜安全的数字货币钱包与多链数字钱包下载",
            "keywords": "钱包,数字货币,数字钱包,TokenPocket钱包,TokenPocket,多链钱包,质押,加密钱包",
            "ogSiteName": "TokenPocket 钱包",
            "themeColor": "#0F1931",
            "description": "TokenPocket 钱包是非托管多链数字钱包，私钥本地加密，支持 BTC、ETH、USDT 等数字货币的收付、闪兑与质押。免费下载 iOS、Android 与浏览器扩展。",
            "ogDescription": "TokenPocket 钱包是非托管多链数字钱包，私钥本地加密，支持 BTC、ETH、USDT 等数字货币的收付、闪兑与质押。免费下载 iOS、Android 与浏览器扩展。"
        },
        "trackers": {
            "requests": 25,
            "trackers": [
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 19
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 33,
                "wait": 574,
                "connect": 6,
                "download": 1
            },
            "response_ms": 616
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 22102,
            "co2_grams": 0.0008,
            "cleaner_than": 55
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.193.198",
                    "host": "logan.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.34.28",
                    "host": "colette.ns.cloudflare.com"
                }
            ],
            "zone": "tokenpotcet.pro"
        },
        "location": {
            "ip": "2606:4700:3033::6815:5524",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "tokenpotcet.pro"
        },
        "dns": {
            "A": [
                "104.21.85.36",
                "172.67.201.227"
            ],
            "NS": [
                "logan.ns.cloudflare.com",
                "colette.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"colette.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418248233, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3033::6815:5524",
                "2606:4700:3032::ac43:c9e3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3032::ac43:c9e3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://tokenpotcet.pro"
            ]
        },
        "linked_pages": {
            "internal_count": 18
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```