tokenpowket[.]com

This domain, tokenpowket.com, is flagged as a brand impersonation phishing site targeting Binance users through a fraudulent TokenPocket wallet interface. Analysis indicates the site mimics legitimate multi-chain wallet services, including support for ETH, BTC, BSC, and other blockchain networks, as evidenced by its page title: 'TokenPocket - 你的通用数字钱包 | TP钱包-ETH钱包-BTC钱包-BSC钱包-HECO钱包-OKExChain钱包-Polkadot钱包-Kusama 钱包-DeFi钱包-Layer 2钱包-EOS钱包-TRX钱包.' The threat type aligns with cryptocurrency phishing, likely deploying credential harvesters or wallet drainers to siphon assets from unsuspecting victims. Infrastructure analysis reveals multiple high-confidence technical indicators. The domain was registered on October 11, 2025, through Ultahost, Inc., and resolves to the IP address 172.67.132.87, hosted on Cloudflare’s network (AS13335). VirusTotal detection rates show 18 out of 95 security vendors flagging the domain as malicious, while it appears on two independent security blocklists: PhishDestroy and PhishingDB. Notably, the domain lacks an SSL certificate, a red flag for secure communication, and its hosting provider’s use of Cloudflare suggests attempts to obscure origin infrastructure. As of the latest assessment, tokenpowket.com has been taken offline, likely due to takedown actions or hosting provider intervention. However, residual risk persists due to the domain’s recent creation date and the potential for re-emergence under altered infrastructure. Users who interacted with the site should immediately revoke wallet permissions, rotate credentials, and monitor linked accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.