apps-tokenpocket[.]net

Analysis indicates that apps-tokenpocket.net is an active high‑risk phishing infrastructure. The domain was registered on 24 March 2026 through Dominet (HK) Limited and resolves to the IP address 154.221.182.222, which is assigned to Cloud Innovation Ltd in Peru. DNS resolution uses the authoritative name servers ns1.domainnamens.com and ns2.domainnamens.com. The site presents an SSL certificate issued by TrustAsia Technologies, Inc. under the LiteSSL RSA CA 2025, and the web server reports Nginx with HSTS and HTTP/3 enabled. Although the HTTP response code is 200, the returned page title reads “404 Not Found”, suggesting a placeholder or takedown page. The infrastructure is associated with the Airdrop Scam phishing kit and is classified as a brand‑impersonation campaign. Independent scanning on VirusTotal recorded detections by 16 of 91 security vendors, and the domain carries a Gridinsoft trust score of 0/100. It is currently listed on at least one security blocklist and has been blocked by PhishDestroy. The available evidence confirms malicious intent, but the exact phishing landing page content has not been publicly disclosed. Defenders should block the domain and its resolved IP at network perimeter, add the associated name servers to threat intel feeds, and monitor for any traffic to the certificate issuer and hosting provider. Ongoing surveillance of related DNS changes and re‑registration attempts is recommended.