zhentishow[.]com

This domain is flagged for elevated risk due to brand impersonation targeting Aptos cryptocurrency users. Analysis indicates the infrastructure was designed to distribute fraudulent wallet software, specifically mimicking TP Wallet under the guise of official downloads. The threat type aligns with crypto drainer distribution, where victims are tricked into installing malicious applications that compromise private keys or seed phrases, leading to unauthorized fund transfers. Infrastructure analysis reveals the domain zhentishow.com was registered on February 25, 2025, through Ripcurl Domains, LLC, and resolved to the IP address 104.21.7.40, hosted on Cloudflare’s network (AS13335). At the time of assessment, 13 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appeared on one security blocklist. The page title, "tpwallet官方正版免费下载|tp官方下载链接|正版TP软件," directly impersonates TP Wallet, a legitimate Aptos-compatible wallet, to deceive users into downloading counterfeit software. The SSL certificate was issued by Let’s Encrypt (R13), a common tactic to lend superficial legitimacy to phishing sites. The domain has since been taken offline, but residual risk remains for users who may have interacted with it prior to deactivation. Mitigation steps for organizations and end-users include blocking the domain and associated IP (104.21.7.40) at the network level, as well as monitoring for indicators of compromise such as unexpected wallet transactions or unauthorized access. Users who downloaded software from this domain should immediately cease using the application, transfer any remaining funds to a new wallet, and conduct a full security audit of their devices. Cryptocurrency service providers are advised to proactively warn users about this impersonation campaign and implement additional verification steps for wallet downloads. Given the elevated risk of financial loss, affected parties should report the incident to relevant cybersecurity authorities and cryptocurrency abuse tracking platforms for further investigation.