petraaptoswallet[.]webflow[.]io

The domain petraaptoswallet.webflow.io is a phishing site engaged in brand impersonation targeting users of the Aptos cryptocurrency platform. It presented itself as a legitimate Aptos wallet interface under the name 'Petra Aptos Wallet' but was designed to steal user credentials and cryptocurrency. No drainer kit was identified, though the site operated as a cryptocurrency scam. As of the latest verification, petraaptoswallet.webflow.io has been taken offline.

Technical indicators confirm the malicious nature of petraaptoswallet.webflow.io. The domain was flagged by 7 of 95 security vendors on VirusTotal, including alphaMountain.ai, ArcSight Threat Intelligence, and BitDefender. It appeared on one security blocklist, PhishDestroy, and was registered through NameCheap, Inc. on February 21, 2026. The site resolved to the IP address 172.64.151.8, hosted by Cloudflare in the US, and used an SSL certificate issued by Google Trust Services (WE1). The observed page title was 'Petra Aptos Wallet - A Crypto Wallet on Aptos', and the site returned an HTTP 404 status at the time of assessment.

Users who interacted with petraaptoswallet.webflow.io should immediately revoke any token approvals and transfer funds to a new, secure wallet. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication. Monitor accounts for unauthorized transactions and report the phishing domain to platforms such as Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in mitigation efforts.