tokenpockgt[.]com[.]cn

This domain is flagged as an elevated-risk brand impersonation threat targeting OKX, a cryptocurrency exchange platform. Analysis indicates the infrastructure was designed to deceive users into disclosing credentials or transferring assets under false pretenses, leveraging the trust associated with the legitimate OKX brand to facilitate fraudulent activity.

Infrastructure analysis reveals the domain tokenpockgt.com.cn was registered on May 24, 2026, and is currently offline. Security vendors on VirusTotal flagged the domain, with 19 out of 95 detecting it as malicious. The domain appears on one security blocklist and was previously blocked by a threat intelligence feed. No associated IP addresses or registrar details were publicly disclosed in available threat intelligence, limiting further infrastructure attribution. The domain’s creation date suggests it was established specifically for short-term malicious operations, a common tactic in phishing campaigns.

Mitigation steps for this threat type include immediate domain suspension via registrar reporting, blacklisting across enterprise security tools, and user education on recognizing brand impersonation tactics. Organizations should monitor for credential theft attempts linked to this domain and implement multi-factor authentication (MFA) to reduce the impact of potential breaches. Security teams are advised to correlate this domain with other OKX-themed phishing infrastructure to identify broader campaign patterns and proactively block related assets. End users should verify domain authenticity through official channels before interacting with any OKX-branded communications or platforms.