tokenpockret[.]pro

On July 24, 2026, tokenpockret.pro was observed as an offline domain that previously hosted a crypto‑related impersonation campaign targeting the Aptos brand. The authoritative DNS records point to Cloudflare’s nameservers carl.ns.cloudflare.com and ryleigh.ns.cloudflare.com, and the domain resolves to the IPv6 address 2a06:98c1:3120::3, which is allocated to AS13335 Cloudflare, Inc. and geolocated to the United States. No TLS certificate was presented for the site, indicating that HTTPS was not configured at the time of capture. The HTML title returned by the server was “TokenPocket”, matching the information supplied by investigators and suggesting an attempt to associate the site with the TokenPocket wallet service. The campaign was classified as a crypto scam and explicitly impersonates the Aptos brand, a detail corroborated by the “Impersonates: aptos” field in the intelligence feed.

The domain appears on a single security blocklist and was flagged by PhishDestroy, demonstrating that at least one anti‑phishing service has taken action against it. Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low reputation. VirusTotal analysis recorded two positive detections out of 95 scanned engines, confirming that some security products recognize the domain as malicious. AlienVault OTX listed the domain in one threat‑intel pulse, providing additional community context.

Because the site is currently offline, active exploitation cannot be confirmed, and the exact content of the landing page remains unknown. However, the combination of brand impersonation, a misleading page title, and the low trust scores indicates a high likelihood of credential‑stealing or wallet‑draining activity. Defenders should continue to block tokenpockret.pro at perimeter firewalls, DNS resolvers, and proxy filters, and should monitor for any re‑registration or resurrection of the domain.