ppwallet[.]vip

Analysis of ppwallet.vip as of July 27 2026 indicates that the domain is actively hosting web content, returning HTTP 200 for requests. Registration data shows the domain was created through GoDaddy.com, LLC, and its authoritative name servers are morgan.ns.cloudflare.com and virginia.ns.cloudflare.com, confirming Cloudflare DNS resolution. The domain appears on a single security blocklist and is listed by PhishDestroy, demonstrating that at least one reputable threat intelligence source has flagged it as malicious.

VirusTotal records reveal that the site has been scanned by 91 antivirus and URL‑reputation engines; none of the vendors reported a detection, but the absence of a positive result does not constitute assurance of safety. The threat classification supplied is “crypto drainer”, implying that the site is likely used to exfiltrate cryptocurrency assets, possibly by delivering malicious scripts or directing victims to fraudulent wallet interfaces. No additional indicators such as SSL certificate details, IP reputation, or specific page titles are available in the current intelligence set.

Consequently, the confidence in the domain’s malicious intent rests on its blocklist inclusion, the active hosting status, and the crypto‑drainer labeling. Defenders should treat ppwallet.vip as hostile: incorporate the domain into URL filtering and DNS‑sinkhole policies, monitor outbound connections for attempts to contact the domain, and consider isolating any internal hosts that have previously resolved or accessed it. Ongoing observation is recommended to capture any emerging payloads or changes in hosting infrastructure, and to update detection rules should new evidence appear.