down[.]tokenpocket-online[.]cn

PhishDestroy identifies down.tokenpocket-online.cn as an active OKX brand impersonation phishing site registered to harvest user credentials and financial data. This domain poses an elevated risk due to its active status, direct impersonation of a major cryptocurrency exchange, and partial detection by security vendors. The infrastructure supporting this campaign has been traced to a specific IP address and incorporates a legitimate SSL certificate, increasing its deceptive effectiveness.

This domain was flagged by 8 out of 95 VirusTotal security vendors, indicating partial but not universal detection. It was registered through Dynadot Inc. on March 22, 2026, and resolves to IP address 103.105.23.29. The use of a Let’s Encrypt SSL certificate suggests an attempt to appear trustworthy, while its recent creation demonstrates opportunistic deployment. Despite low-blocklist visibility at present, the combination of these factors signals a credible threat to users seeking OKX services.

Users should immediately avoid accessing down.tokenpocket-online.cn and verify any OKX-related links through official channels. Organizations are advised to block this domain at the network level and update browser and DNS blocklists accordingly. If credentials were entered, users must revoke access on the legitimate OKX platform and enable two-factor authentication. Security teams should inspect outbound traffic to IP 103.105.23.29 for signs of compromise and consider this domain a high-confidence indicator of credential harvesting attempts targeting OKX users.