app-tokenpocketpro[.]com

PhishDestroy identifies app-tokenpocketpro.com as an active brand-impersonation domain targeting OKX with a fake login interface designed for credential theft and crypto asset draining. The infrastructure is provisioned to harvest user credentials under the guise of a legitimate wallet interface. No evidence yet of a deployed drainer kit payload, but the landing page is engineered to mimic OKX’s official login flow, increasing the risk of successful phishing. This domain resolves to IP 154.216.98.106 and is served over a Let’s Encrypt SSL certificate. It was registered on 2024-10-14 through Dominet (HK) Limited, a registrar associated with high-risk domain churn. VirusTotal currently shows 2/95 detections, indicating zero detection coverage as of the latest scan. Google Safe Browsing (GSB) status remains unflagged, and the domain has not yet propagated to major blocklists, leaving end users exposed. The threat is under active investigation with status marked as active. PhishDestroy recommends blocking the domain at network and endpoint levels and advises users to verify destination URLs via PhishDestroy before entering credentials or transferring assets. Remaining risk is elevated due to zero detections, unflagged GSB status, and the domain’s recent creation, which is typical in evolving phishing campaigns.