tpulse[.]fun

This domain, tpulse.fun, operates as a fraudulent cryptocurrency token aggregator designed to harvest wallet credentials and private keys. Analysis indicates the site mimics legitimate multi-chain platforms, presenting users with fake interfaces that prompt connection of cryptocurrency wallets. The page title 'Token Pulse — All Networks' suggests an attempt to deceive users into believing they are interacting with a genuine cross-chain service, while instead capturing sensitive authentication details. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain is flagged by 6 of 95 security vendors on VirusTotal, including detection by wallet protection systems. It appears on four distinct security blocklists and is currently blocked by at least four specialized cryptocurrency security tools. Registered through PDR Ltd. d/b/a PublicDomainRegistry.com on March 07, 2026, the domain resolves to Cloudflare IP 104.21.39.72, utilizing Cloudflare's network infrastructure including HTTP/3 and HSTS. The creation date discrepancy (2026) suggests domain age manipulation to evade detection mechanisms. Users who visited tpulse.fun should immediately revoke any wallet connections made through the site. All connected wallets should be considered compromised, requiring migration of funds to new addresses. Browser data should be cleared to remove any stored credentials or session tokens. Monitoring for unauthorized transactions is recommended, particularly for any assets that may have been exposed during the interaction. The domain's current offline status does not eliminate the risk to previously exposed credentials, which may be used in subsequent attacks.