tokinft[.]com

tokinft.com posed a direct threat as a crypto drainer, a type of phishing site designed to steal cryptocurrency wallet credentials and drain associated funds. By impersonating Toki NFT, a legitimate NFT marketplace, the domain tricked users into connecting their wallets or entering sensitive information, which would then be siphoned off by attackers. This specific threat goes beyond simple credential theft, as crypto drainers execute transactions directly from victims' wallets once access is granted.

Evidence collected by PhishDestroy shows that tokinft.com was flagged by 1 out of 95 security vendors on VirusTotal, indicating low but notable detection. The domain was registered through Dynadot LLC on September 10, 2025, just days before being identified, suggesting it was created specifically for malicious purposes. The SSL certificate was issued by Amazon RSA 2048 M04, and the site resolved to IP address 108.138.26.56. It also appeared on one security blocklist, reinforcing its malicious nature.

If users visited tokinft.com, they should immediately disconnect any cryptocurrency wallets that were connected, revoke permissions for the site, and transfer any remaining funds to a new wallet. Running a security scan on their device is also recommended. No credentials or personal information should have been entered, and if they were, users should change passwords and enable two-factor authentication on all associated accounts. Additionally, they should monitor their wallet activity for any unauthorized transactions and report the incident to relevant authorities or platforms.