tokenpockets[.]vip

This domain tokenpockets.vip is currently active and resolves to the IP address 188.114.97.3. The domain was registered through Cloudflare, Inc. on March 22, 2026. It targets the OKX brand through impersonation techniques. The SSL certificate is issued by Google Trust Services. Technologies in use include jQuery along with Cloudflare services and HTTP/3 protocol support. The observed page title remains Document. Detection metrics indicate substantial concern with 14 out of 95 security vendors on VirusTotal marking the domain as malicious. The domain is listed on 4 separate security blocklists and has been included in 23 different threat intelligence pulses tracked by AlienVault OTX. A Gridinsoft trust score of 0 out of 100 further reflects the low confidence level assigned to this infrastructure. Blocking actions have been implemented by SEAL, MetaMask, PhishDestroy, and BLP-Malware. Details on the precise operational methods or additional connected domains remain uncertain based on the provided intelligence. The specific content served beyond the observed title is not fully documented in current records. Attribution to particular threat actors or confirmation of campaign scale cannot be established from the available data alone. Defenders are recommended to incorporate the IP 188.114.97.3 and the domain tokenpockets.vip into monitoring and blocking systems. Continuous review of VirusTotal reports, blocklist updates, and OTX pulses will assist in tracking any evolution of the threat. Organizations should prioritize verification of brand-related domains to reduce exposure to impersonation risks associated with this infrastructure.