tokenpocketpro[.]i-xn[.]cc

The domain tokenpocketpro.i-xn.cc was a phishing site engaged in brand impersonation, specifically targeting users by mimicking Google services. It posed an elevated risk as a tech-support scam, not a crypto drainer, and has since been taken offline. Victims may have been tricked into revealing sensitive information or downloading malicious software under the guise of legitimate support.

Technical analysis shows tokenpocketpro.i-xn.cc was registered through NameCheap, Inc. on February 21, 2026, and resolved to the IP address 198.54.115.169, hosted by Namecheap, Inc. in the US. At the time of assessment, 2 of 95 VirusTotal security vendors flagged the domain, while 1 security blocklist (PhishDestroy) had listed it. No SSL certificate was available, and the observed page title impersonated TokenPocket, a cryptocurrency wallet, despite the scam type being unrelated to crypto draining. The domain used nameservers dns1.namecheaphosting.com and dns2.namecheaphosting.com.

Users who interacted with tokenpocketpro.i-xn.cc should immediately change any passwords entered on the site, enable two-factor authentication (2FA) on all accounts, and monitor for unauthorized access or fraudulent activity. If personal or financial information was disclosed, consider contacting relevant institutions to secure accounts. Report the phishing domain to Google Safe Browsing, the registrar (NameCheap), and platforms like PhishTank or the Anti-Phishing Working Group to aid in takedown efforts.