tokenpockit[.]com[.]cn

PhishDestroy identifies tokenpockit.com.cn as an active OKX impersonation site designed to steal login credentials and personal data from unsuspecting cryptocurrency traders. The domain mimics the branding and website layout of the legitimate OKX exchange, tricking users into entering sensitive account information on a counterfeit login page. Once harvested, stolen credentials can be used to drain wallets or sell on dark web markets, leaving victims financially exposed and compromised across other platforms where the same passwords were reused. This domain was flagged via automated monitoring after VirusTotal showed 0 detections out of 95 security engines, highlighting how new impersonation sites evade detection. The site’s registration date of March 25, 2024, and hosting on IP 154.206.139.86 via Dynadot Inc. point to a recent, fast-moving campaign using low-cost registrars and legitimate SSL certificates from Let’s Encrypt to appear trustworthy. The lack of detections underscores the importance of proactive domain monitoring and user verification—especially when links appear in ads, DMs, or search results. If you visited tokenpockit.com.cn, immediately change your OKX password using a different device or browser. Enable two-factor authentication on OKX and revoke any API keys issued from this session. Scan your device with updated antivirus software and monitor your wallet and email for unauthorized transactions. Report the site to OKX abuse@okx.com and file a complaint with your local cybercrime unit or IC3. Never enter login details on any site reached from ads or unsolicited messages—always navigate directly to the official URL (okx.com) and verify the SSL certificate and domain spelling.