tpwallet[.]me

This domain, www.tpwallet.me, is flagged as a confirmed tech support scam with elevated risk, currently offline as of July 24, 2026. Analysis indicates the domain impersonates Google, a detail supported by its classification in available threat intelligence. The page title, 'imtoken,TokenPocket,BitPie(比特派),Trust Wallet,TronLink(波宝),MetaMask,小狐狸钱包,TP钱包 - 区块链钱包圈网址导航站,' suggests an attempt to aggregate cryptocurrency wallet users, though the exact content and functionality of the site remain unconfirmed due to its offline status. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., and resolves to IP 149.104.2.28, hosted in Hong Kong under AS932 (XNNET LLC).

No SSL certificate was detected, increasing the likelihood of unencrypted communications. Detection coverage is limited but notable: 2 of 93 security vendors on VirusTotal flagged the domain, and it appears on one security blocklist (PhishDestroy). Gridinsoft assigned a trust score of 0/100, reinforcing its malicious classification.

Defenders should treat this domain as a confirmed threat vector for tech support scams, particularly targeting users searching for cryptocurrency wallet services. Block access to 149.104.2.28 and monitor for any re-registration or DNS changes. Given the domain's offline status, further analysis of its infrastructure or payload is not currently possible, but historical associations with the IP and registrar should be reviewed for additional indicators of compromise.