tonkeeper-walle[.]com

This domain, tonkeeper-walle.com, operates as a fraudulent cryptocurrency wallet phishing site designed to harvest user credentials and private keys. Analysis indicates the site mimics legitimate wallet interfaces, tricking victims into entering sensitive information that enables unauthorized access to digital assets. The threat extends to potential malware distribution if users download fake wallet applications or browser extensions linked from the domain. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., with an unusually future creation date suggesting potential domain spoofing or typosquatting. It resolves to IP address 188.114.97.3 (AS13335) and appears on one security blocklist. VirusTotal detection rates show 19 out of 95 security vendors flagging the domain as malicious, with classifications including phishing and fraud. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, is commonly abused by threat actors to lend false credibility to malicious sites. Users who accessed tonkeeper-walle.com should immediately revoke any entered credentials and monitor associated cryptocurrency wallets for unauthorized transactions. If wallet recovery phrases or private keys were submitted, transfer assets to a new, secure wallet and assume the original is compromised. System scans for malware are recommended if any files were downloaded from the domain. Network administrators should block the domain and its resolving IP (188.114.97.3) at the perimeter, and monitor for connections to this infrastructure. The domain is currently offline, but threat actors may re-establish it under a different name or IP.