tokenpocket[.]hk[.]cn

tokenpocket.hk.cn was registered on August 10, 2025 through 厦门易名科技股份有限公司 and is currently offline. The authoritative nameservers are chan.ns.cloudflare.com and west.ns.cloudflare.com, pointing the domain to the Cloudflare edge address 104.21.80.1, which resolves to an IP located in the United States under ASN 13335 (Cloudflare, Inc.). No SSL certificate is presented, indicating that HTTPS connections are not available. The site’s page title, captured before takedown, reads "TokenPocket - 你的通用数字钱包 | TP钱包-ETH钱包-BTC钱包‑BSC钱包‑HECO钱包‑OKExChain钱包‑Polkadot钱包‑Kusama 钱包‑DeFi钱包‑Layer 2钱包‑EOS钱包‑TRX钱包", and the domain is classified as a crypto‑scam that impersonates the Binance brand.

Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist. VirusTotal reports that 15 of 95 scanning engines flag the domain as malicious, reinforcing the suspicion of malicious activity. AlienVault OTX lists the domain in 15 distinct threat‑intel pulses, and PhishDestroy has recorded it as blocked.

The combination of a recent registration, use of Cloudflare’s public infrastructure, lack of TLS, low trust rating, multiple vendor detections, and explicit brand impersonation suggests a high likelihood that the site was used to lure victims into handing over cryptocurrency credentials or funds. Defenders should continue to block the domain at network perimeter filters, update DNS blacklists with the observed IP and nameserver entries, and monitor for any future resurrection of the domain or similar impersonation attempts targeting Binance users. Because the site is offline, live analysis of payloads or redirects is not possible; however, the documented indicators provide sufficient evidence to treat the domain as malicious and to incorporate the associated IOCs into existing threat‑hunting rules.