wallet-aptos[.]com

The domain wallet-aptos.com was registered on March 11, 2026 through Metaregistrar BV and immediately pointed at Cloudflare’s edge network (IP 104.21.31.162, AS13335, United States). The authoritative name servers dave.ns.cloudflare.com and leia.ns.cloudflare.com confirm the use of Cloudflare’s DNS platform. A Google Trust Services / WE1 SSL certificate is present, indicating a valid TLS handshake but offering no assurance of legitimacy. The site title, "Wallet Aptos - Complete Guide to Aptos Ecosystem, Wallets & DEX Platforms," suggests content aimed at cryptocurrency wallet users, yet the intelligence tag lists the impersonated brand as "across" and classifies the operation as a wallet/seed phishing campaign.

The domain appears in eight AlienVault OTX pulses and is listed on three security blocklists, specifically PhishDestroy, MetaMask, and SEAL, indicating that multiple protective services have taken active mitigation steps. VirusTotal analysis shows a single security vendor flagging the domain out of ninety‑four scans, reinforcing the suspicion of malicious intent. Gridinsoft assigns a trust score of 0 out of 100, further confirming the domain’s poor reputation. The site is currently offline, but its recent creation date and rapid appearance on threat feeds suggest a short‑lived, targeted campaign.

Defenders should continue to block wallet-aptos.com at DNS and network layers, monitor for any resurgence of the domain or its IP address, and apply URL filtering rules that reference the listed blocklists. Analysts should also watch for new domains registered by the same registrar or using similar naming patterns, as the threat actor may recycle infrastructure. The lack of publicly available page content limits deeper content analysis, so threat intelligence sharing should focus on the observed infrastructure and the single vendor detection reported by VirusTotal.