tokenpocketwell[.]cc

The domain tokenpocketwell.cc is a confirmed phishing site engaged in brand impersonation targeting OKX, a major cryptocurrency exchange. It operated as a cryptocurrency scam designed to deceive users into transferring funds under false pretenses, though no drainer kit was identified. As of the latest verification, tokenpocketwell.cc has been taken offline, but prior activity indicates an elevated risk for those who interacted with it.

Technical indicators confirm the malicious nature of tokenpocketwell.cc. The domain was flagged by 3 of 95 security vendors on VirusTotal, including CyRadar, Forcepoint ThreatSeeker, and G-Data. It appeared on 2 security blocklists, specifically PhishDestroy and ScamSniffer. Registered through Dominet (HK) Limited on July 25, 2025, the domain resolved to the IP address 47.83.212.19, hosted by Alibaba (US) Technology Co., Ltd. in Hong Kong. The SSL certificate was issued by Let's Encrypt (R12), and the observed page title was '转账' (translation: 'Transfer'). Technologies detected on the site included Nginx, Unpkg, jsDelivr, HSTS, crypto-js, and HTTP/3. Gridinsoft assigned a trust score of 0 out of 100.

Users who visited tokenpocketwell.cc should assume their cryptocurrency wallet or credentials may be compromised. Immediately revoke any token approvals granted to unknown contracts and transfer remaining funds to a new, secure wallet. If login credentials were entered, change passwords on the legitimate OKX platform and enable two-factor authentication. Report the phishing domain to OKX support, local cybercrime authorities, and platforms like Google Safe Browsing or PhishTank to aid in broader mitigation efforts.