tp[.]wallet-v3[.]top

Analysis of the domain tp.wallet-v3.top indicates an elevated-risk crypto scam targeting the Aptos brand, as documented on July 23, 2026. The domain was registered on December 23, 2025, through GoDaddy.com, LLC, and resolves to the IP address 70.39.200.168, hosted in Hong Kong under AS979 (NetLab Global). Infrastructure analysis reveals the use of GoDaddy’s nameservers (ns17.domaincontrol.com and ns18.domaincontrol.com), a common registrar choice for both legitimate and malicious domains. At the time of assessment, the domain was offline, with no SSL certificate detected, which may reduce victim trust but does not eliminate risk. Security vendor detections on VirusTotal report 16 of 93 engines flagging the domain, providing moderate confidence in its malicious classification.

The domain appears on at least one security blocklist and is explicitly blocked by PhishDestroy. Gridinsoft’s trust score of 0/100 further corroborates its high-risk status. While the exact page content remains unanalyzed, the scam type is classified as a crypto scam, and the domain is confirmed to impersonate Aptos, a known blockchain platform. No evidence of a phishing kit or additional brand impersonation was provided in the available intelligence.

Defenders should prioritize blocking the domain and its associated IP (70.39.200.168) at the network level, particularly in environments where cryptocurrency-related activity occurs. Monitoring for newly registered domains under similar naming conventions (e.g., wallet-v3, wallet-secure) may help preempt future campaigns. Given the domain’s offline status, further investigation into hosting infrastructure and registrar abuse reports is recommended to assess residual risk. The absence of an SSL certificate and the domain’s presence on multiple detection platforms suggest it was operational long enough to be flagged, though its current takedown status limits immediate threat exposure.