pokgh[.]com

PhishDestroy identifies pokgh.com as a live cryptocurrency-draining domain that actively lures victims under the guise of a spoofed brand interface. This domain operates a generic crypto-drainer kit designed to siphon private keys and tokens from unsuspecting users during wallet connection flows. No specific brand impersonation has been confirmed at this stage, but the drainer employs obfuscated JavaScript to intercept and exfiltrate transaction approvals without user consent.

This domain resolves to IP 64.236.164.8 and leverages a Let’s Encrypt SSL certificate to appear legitimate. It was registered on March 24, 2026 through OwnRegistrar, Inc., and currently shows a VirusTotal detection score of 9 out of 95 security vendors. Google Safe Browsing (GSB) has not yet blacklisted this domain, and no public blocklist hits are recorded in major threat intelligence feeds. Despite its recent creation, the domain has already drawn attention from multiple AV engines, signaling elevated malicious intent.

As of this report, pokgh.com remains active and unblocked across most network defenses. Immediate response includes updating browser and DNS blocklists to include this domain and IP. Users are strongly advised to avoid visiting pokgh.com and to verify any similar domains using PhishDestroy’s real-time threat lookup. While the risk is elevated due to active hosting and cryptocurrency targeting, proactive blocking can prevent further compromise. Remaining risk persists for users who may encounter the domain through social engineering campaigns or malvertising.