tokenpocketupgrade[.]fun

On July 24, 2026, tokenpocketupgrade.fun was identified as a brand‑impersonation domain targeting Google. The domain was first registered on December 30, 2025 through Atak Domain and is currently marked as taken offline. Infrastructure analysis shows the domain resolves to IP address 216.58.206.36, which is owned by Google LLC (AS15169) and geolocated in Germany. The domain uses Cloudflare’s authoritative nameservers nash.ns.cloudflare.com and raina.ns.cloudflare.com, but no TLS certificate is presented, indicating the site does not serve HTTPS content. Passive observation recorded a page title of “Google”, directly matching the declared brand target.

The domain received a Gridinsoft trust score of 0 out of 100, reflecting a high confidence of malicious intent. It appears on two security blocklists and is explicitly blocked by PhishDestroy and ScamSniffer. VirusTotal scans show that eight of ninety‑three antivirus vendors flagged the domain as malicious. AlienVault OTX lists the domain in one threat‑intel pulse, further corroborating its reputation. The site is classified as a crypto scam, although no additional payload details are available because the domain is offline and no content has been captured beyond the page title.

Defenders should immediately block tokenpocketupgrade.fun at perimeter and endpoint filters, monitor the associated IP address for any future activity, and add the domain to internal blacklist feeds. Continuous monitoring of Cloudflare name‑server changes and any re‑registration attempts is advised, as threat actors often recycle infrastructure. Because the domain leverages a legitimate Google IP, network‑level detection may rely on DNS and reputation data rather than payload inspection.