tokenpocketb[.]com[.]cn

The domain tokenpocketb.com.cn is identified as a high-risk brand impersonation threat targeting the cryptocurrency exchange OKX. The domain is currently offline, but it has been flagged for its malicious activities and potential to deceive users into believing they are interacting with legitimate OKX services.

Infrastructure analysis reveals that tokenpocketb.com.cn was flagged by 18 of 95 VirusTotal security vendors, indicating a significant level of suspicion among the cybersecurity community. The domain resolves to the IP address 154.206.128.227 and was hosted using the Nginx web server. It also employed HSTS (HTTP Strict Transport Security) to enforce secure connections, which is a common tactic to gain user trust. The domain's SSL certificate was issued by Let's Encrypt, a reputable certificate authority often misused by threat actors due to its ease of acquisition. The domain appears on three security blocklists and has a Gridinsoft trust score of 0/100, further confirming its malicious nature. AlienVault OTX data indicates that the domain has been mentioned in two threat intelligence pulses, highlighting its involvement in known malicious campaigns.

Given the current status of the domain as offline, it is recommended that users and security teams remain vigilant against similar impersonation attempts. Organizations should ensure that their network security measures, such as DNS filtering and web content blocking, are updated to include this domain and its associated IP address. Additionally, users should be educated to verify the legitimacy of websites and URLs, especially those related to financial transactions and cryptocurrency exchanges. Security teams should monitor for any related infrastructure and report any new instances to relevant authorities and threat intelligence platforms.