tokenpocketweb3[.]cn

PhishDestroy first observed tokenpocketweb3.cn on May 15, 2026. The hostname explicitly references Tokenpocket; stored content metadata identifies the same apparent target. The captured page title is “TokenPocket官方下載 - Web3數字錢包服務中心”. Stored page analysis classifies the content as credential phishing. Current evidence score: 100/100 (critical).

Positive findings are stored from 2 sources: VirusTotal and DNS security resolvers. VirusTotal recorded 18 detections among 91 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, CRDF, CyRadar, ESET, Emsisoft, Fortinet, G-Data, Gridinsoft, Kaspersky, LevelBlue, Lionic, Netcraft, SOCRadar, Sophos, VIPRE, Webroot on Aug 8, 2026 at 02:17 UTC. DNS security checks returned 1 blocking result across 14 tested policies: Brand Tokenpocket; no observation timestamp was retained. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 06:20 UTC. URLQuery recorded no positive detection; no observation timestamp was retained. On May 15, 2026 at 04:48 UTC, Google Safe Browsing returned no flag; PhishStats returned no feed match. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 02:37 UTC.

HTTP 200 was recorded on Aug 7, 2026 at 22:26 UTC. Registration records for the domain list 阿里云计算有限公司（万网） as the registrar and May 10, 2026 as the creation date. Registration preceded first observation by 4 days. At collection time, the hostname resolved to 154.215.156.78 on AS134175 (SH2206-AP). The recorded endpoint location is Hong Kong, HK. The stored server header is nginx. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Aug 9, 2026; checked May 15, 2026 at 08:00 UTC.

The content indicators and 2 positive source findings support the current Tokenpocket-themed credential phishing classification.