tokenpockct[.]com[.]cn

This domain is flagged for elevated-risk brand_impersonation, specifically targeting OKX, a cryptocurrency exchange platform. Analysis indicates the infrastructure was designed to deceive users by mimicking legitimate OKX services, likely for credential harvesting or fraudulent transactions. The threat type aligns with known tactics used in cryptocurrency-related phishing campaigns, where attackers exploit brand trust to compromise user accounts or distribute malicious payloads. Infrastructure analysis reveals the domain tokenpockct.com.cn was created on May 24, 2026, and is currently offline. It appears on 1 security blocklist and was blocked by PhishDestroy. VirusTotal reports 19 out of 95 security vendors flagging the domain as malicious. No associated IP addresses or registrar details were provided in the available intelligence. The domain's trust scores and detection rates confirm its classification as a high-confidence malicious entity. Mitigation steps for this threat type include immediate blocking of the domain across all network security controls, including firewalls, DNS filters, and email gateways. Organizations should conduct a retrospective analysis of logs to identify any prior connections to tokenpockct.com.cn and assess potential compromise. Users who may have interacted with the domain should be instructed to reset credentials for OKX and any associated accounts, enable multi-factor authentication, and monitor for unauthorized transactions. Security teams should also update detection rules to identify similar impersonation domains targeting cryptocurrency platforms.