tokenpocket[.]onl

PhishDestroy identifies an active brand impersonation campaign using the domain tokenpocket.onl to deceive users into believing it is an official OKX service. This domain is designed to mimic the legitimate OKX cryptocurrency exchange, tricking victims into entering sensitive credentials or downloading malicious software under the guise of wallet management or trading tools. Users who interact with this domain risk account takeovers, financial theft, or malware infections targeting digital assets. This domain was flagged by PhishDestroy’s threat intelligence pipeline, revealing it registered through Dynadot Inc on October 01, 2025, uses a Google Trust Services SSL certificate, and currently shows 3 out of 95 VirusTotal detections—indicating it has not yet been widely recognized as malicious. It resolves to IP address 188.114.96.3, which has been linked to previous low-detection phishing infrastructure. The combination of a freshly registered domain, high-risk impersonation, and low detection rate makes this a credible early-stage threat. If you visited tokenpocket.onl, disconnect from the internet immediately and scan all devices for malware using a reputable antivirus tool. Revoke any credentials entered on the site, enable two-factor authentication on all cryptocurrency accounts, and report the domain to your security team or via PhishDestroy’s threat submission portal. Do not re-enter sensitive information or download files from this domain. Monitor financial accounts for unauthorized transactions and consider rotating API keys or wallet addresses if exposed. The risk remains active and evolving—remain cautious and verify all URLs before interaction.