tokenpockdt[.]com[.]cn

This domain, tokenpockdt.com.cn, poses a direct threat as a brand impersonation scheme targeting users of the OKX cryptocurrency exchange platform. Analysis indicates the infrastructure was designed to mimic legitimate OKX wallet interfaces, likely deploying credential harvesting or crypto drainer scripts to siphon digital assets from unsuspecting victims. The domain’s design and naming conventions closely resemble authentic OKX services, increasing the likelihood of successful deception among users seeking wallet access or trading functionalities. Evidence supporting this assessment includes multiple technical indicators: the domain is flagged by 20 out of 95 security vendors on VirusTotal, appears on one security blocklist, and was registered on May 24, 2026, through a Chinese domain registrar. The creation date suggests premeditated fraudulent activity, as it predates typical defensive registration timelines. Additionally, the domain was blocked by at least one threat intelligence feed, further corroborating its malicious intent. Users who visited tokenpockdt.com.cn should immediately revoke any connected wallet permissions, reset credentials for associated accounts, and monitor transaction histories for unauthorized activity. It is recommended to scan local devices for malware, as crypto drainers often deploy persistent payloads. If financial losses occurred, affected parties should report the incident to relevant cybercrime authorities and their cryptocurrency exchange provider for potential recovery assistance. Proactive monitoring of similar domains (e.g., typosquatting variants) is advised to mitigate future risks.