defi-tokenpocket[.]com

PhishDestroy identifies defi-tokenpocket.com as an active crypto drainer mimicking the OKX brand to steal digital assets. This domain was registered on October 04, 2025 through Dominet (HK) Limited and resolves to IP 154.216.99.104 using a Let's Encrypt SSL certificate. To date, it remains undetected by 95 VirusTotal engines, indicating a low detection rate despite clear malicious intent. The domain’s recent creation and lack of blocklist presence suggest an emerging and rapidly evolving threat. The specific threat posed by defi-tokenpocket.com is a crypto drainer designed to deceive users into connecting their wallets or entering credentials under the false pretense of being an official OKX platform. Victims may unknowingly authorize malicious smart contract interactions or input private keys into fraudulent forms, leading to irreversible asset loss. Given the domain’s recent registration and absence of AV detections, it is likely part of a coordinated campaign targeting DeFi users seeking alternative platforms or tools. Technical indicators such as the Let's Encrypt SSL certificate and resolution to a single IP address hosted in an untrusted jurisdiction further underscore its malicious nature. Users who visited defi-tokenpocket.com should immediately disconnect any connected wallets using tools like WalletConnect or MetaMask’s disconnect feature. Revoke any suspicious token approvals via reputable blockchain explorers such as Etherscan or BscScan. If credentials or private keys were entered, assume compromise and transfer remaining assets to a newly generated, secure wallet. Report the domain to PhishDestroy and your local cybercrime unit to aid in blocking efforts. Avoid interacting with similar domains and always verify official URLs through primary brand channels or trusted threat intelligence platforms.