pocketex[.]cc

This domain is flagged as a high-risk brand impersonation threat specifically designed to deceive users into engaging with a fraudulent investment platform. Analysis indicates the domain mimics decentralized trading services, a tactic commonly employed in investment scams to exploit victims seeking financial opportunities in cryptocurrency or Web3 ecosystems. The threat type is narrowly defined as brand impersonation with a financial fraud objective, distinct from generic phishing or credential theft schemes. Infrastructure analysis reveals multiple concrete indicators of malicious activity. The domain pocketex.cc is registered through Gname.com Pte. Ltd. and resolves to the IP address 188.114.96.3. It was created on December 12, 2025, an unusually recent date that aligns with short-lived fraudulent domains. Security vendors on VirusTotal flagged the domain at a rate of 14/95, while Google Safe Browsing specifically labeled it under SOCIAL_ENGINEERING. The domain appears on three security blocklists and is actively blocked by MetaMask, PhishDestroy, and SEAL. AlienVault OTX records its presence in one threat intelligence pulse, and Gridinsoft assigns it a trust score of 0/100, further corroborating its malicious nature. Mitigation steps for this threat type require a multi-layered approach. Organizations and individuals should immediately block the domain and its associated IP address at the network perimeter to prevent access. Users who may have interacted with the domain should revoke any connected wallet permissions and monitor financial accounts for unauthorized transactions, as investment scams often involve cryptocurrency drainers or unauthorized fund transfers. Security teams should conduct retrospective log analysis to identify any prior engagement with the domain or its infrastructure. Given the domain's current offline status, continuous monitoring for re-emergence under similar naming conventions or infrastructure is critical. Awareness training should emphasize the risks of decentralized trading impersonation, particularly the use of fake Web3 platforms to exploit trust in emerging financial technologies.