tokenpocket[.]ceo

This domain, tokenpocket.ceo, is identified as a brand impersonation threat targeting OKX, a major cryptocurrency exchange platform. Analysis indicates the site mimics legitimate OKX wallet interfaces to deceive users into disclosing credentials or authorizing malicious transactions, consistent with crypto drainer or fake login page tactics. No specific drainer kit signatures were confirmed, but the domain’s structure and naming convention align with known impersonation schemes in the cryptocurrency sector. Technical indicators reveal the domain was registered on March 28, 2026, through Porkbun, LLC, an uncommon registrar for fraudulent domains but not unprecedented in phishing operations. It resolves to the IP address 188.114.97.3, which has been associated with other low-reputation hosting providers. VirusTotal detection shows 14 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its free and automated issuance process. Google Safe Browsing status is not provided, but the domain’s presence in a single threat intelligence pulse on AlienVault OTX suggests limited but confirmed malicious activity. As of the latest assessment, tokenpocket.ceo has been taken offline, reducing immediate exposure risk. However, the infrastructure remains a latent threat, as domains registered through the same registrar or resolving to the same IP may resurface under different names. Users who interacted with the domain should revoke any connected wallet authorizations, monitor accounts for unauthorized transactions, and verify the legitimacy of any linked applications. Organizations should update blocklists to include the domain and IP, while security teams should investigate related indicators for potential campaign linkages.