# PhishDestroy domain threat record: my-new-bnb-bsccoin.surge.sh Content language: English Canonical HTML report: https://phishdestroy.io/domain/my-new-bnb-bsccoin.surge.sh/ Machine-readable companion: https://phishdestroy.io/domain/my-new-bnb-bsccoin.surge.sh/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-02 13:37:21 UTC - Last availability or vendor check: 2026-10-21 01:37:26 UTC - Stored record updated: 2026-10-22 14:23:29 UTC - VirusTotal detections in the stored snapshot: 16/89 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: ScamSniffer - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Trust Wallet ## Stored infrastructure - Observed IP address: 188.166.132.94 - Registrar in stored WHOIS data: Surge.sh - Last stored HTTP status: 451 - Registration date (registry RDAP, surge.sh): 2014-07-25 23:10:53 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a06255-df52-7279-9a0c-8fea3e95d285/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/my-new-bnb-bsccoin.surge.sh - Certificate Transparency search: https://crt.sh/?q=%25.my-new-bnb-bsccoin.surge.sh - Web Archive lookup: https://web.archive.org/web/*/https://my-new-bnb-bsccoin.surge.sh/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview my-new-bnb-bsccoin.surge.sh is an impersonation phishing page that poses as Trust Wallet under the title "Transfer Trust Wallet". The subdomain's wording, "new bnb bsccoin", is aimed at holders of BNB and BNB Smart Chain tokens who might expect a migration or new-coin event. PhishDestroy first flagged it on 2026-09-02. As of 2026-10-19 the site was still online and serving its phishing content. How the scam works A page titled "Transfer Trust Wallet" frames itself as a wallet transfer or migration step, a common pretext for convincing users that their funds must be moved or re-verified. Fake Trust Wallet pages of this kind typically ask the visitor to type in their 12- or 24-word recovery phrase, or to connect a wallet and sign a request presented as a routine transfer. A recovery phrase gives the attacker full control of the wallet and every asset in it. A signed approval can let them pull tokens out without any further action from the victim. Evidence On 2026-09-16, 16 of 89 VirusTotal engines classified the page as malicious. Those engines include BitDefender, ESET, Fortinet, G-Data, Forcepoint ThreatSeeker, alphaMountain.ai, CyRadar and the Vietnamese anti-scam project Chong Lua Dao. ScamSniffer, a crypto-focused blocklist, also lists the domain alongside PhishDestroy. Agreement across general security vendors and a wallet-security specialist makes the Trust Wallet impersonation verdict well supported. Infrastructure The page sits on Surge.sh, a free static-site publishing platform. Anyone can create a throwaway subdomain there in seconds without registering a domain. The content is served from DigitalOcean, LLC infrastructure in the Netherlands. Its Sectigo DV certificate belongs to the shared platform, so the padlock in the browser says nothing about who runs this page. What to do If you entered your recovery phrase here, treat the wallet as lost. Create a new wallet with a fresh phrase on a trusted device and move any remaining funds to it immediately. If you connected a wallet or signed anything, revoke token approvals for that address with a reputable approval checker and watch it for unexpected transfers. Trust Wallet never asks you to "transfer" or re-verify your wallet through a website, so ignore any such prompt. Defenders should block the subdomain, report it to Surge.sh and DigitalOcean, and add it to filters for wallet-themed lures. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a06255-df52-7279-9a0c-8fea3e95d285/ VirusTotal report: https://www.virustotal.com/gui/domain/my-new-bnb-bsccoin.surge.sh Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=my-new-bnb-bsccoin.surge.sh Archived copy: https://web.archive.org/web/20260917093422/https://my-new-bnb-bsccoin.surge.sh/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:51:46 UTC ## Stored page captures - Primary capture: https://i.ibb.co/ZRH84YRq/c8f56d7ddeed.png Captured: 2026-09-02 13:37:21 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a06255-df52-7279-9a0c-8fea3e95d285.png Captured: 2026-09-02 13:37:21 UTC Source report: https://urlscan.io/result/01a06255-df52-7279-9a0c-8fea3e95d285/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5e245293-bc59-4eab-9df5-a6ac71727dc7.png Captured: 2026-09-02 14:20:02 UTC Source report: https://radar.cloudflare.com/scan/5e245293-bc59-4eab-9df5-a6ac71727dc7 SHA-256: 0e10a0f2260aac1ee8dd06922cc7f6cd647d1fe61d59fe152f3af4b2f265b1f5 - URLScan · 2026-09-02: https://screenshots.phishdestroy.io/us/01a06244-2660-761c-ae17-004008d199db.png Captured: 2026-09-02 13:17:15 UTC Source report: https://urlscan.io/result/01a06244-2660-761c-ae17-004008d199db/ SHA-256: 85abd1b5201e61f4e43a9f9da2fa9e1530552a3e559d250e3262db8f4d3d98b5 - URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06abe-833a-703a-ae6d-1fa1a0fe10fa.png Captured: 2026-09-04 04:47:57 UTC Source report: https://urlscan.io/result/01a06abe-833a-703a-ae6d-1fa1a0fe10fa/ SHA-256: 85abd1b5201e61f4e43a9f9da2fa9e1530552a3e559d250e3262db8f4d3d98b5 - URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06da7-4b1c-70ca-8fce-71f2b4321558.png Captured: 2026-09-04 18:21:23 UTC Source report: https://urlscan.io/result/01a06da7-4b1c-70ca-8fce-71f2b4321558/ SHA-256: 85abd1b5201e61f4e43a9f9da2fa9e1530552a3e559d250e3262db8f4d3d98b5 - URLScan · 2026-09-09: https://screenshots.phishdestroy.io/us/01a08416-8d83-736c-9562-e5c512a3a6ef.png Captured: 2026-09-09 02:54:32 UTC Source report: https://urlscan.io/result/01a08416-8d83-736c-9562-e5c512a3a6ef/ SHA-256: 85abd1b5201e61f4e43a9f9da2fa9e1530552a3e559d250e3262db8f4d3d98b5 - URLScan · 2026-09-15: https://screenshots.phishdestroy.io/us/01a0a45d-49e3-7358-ba27-5528aa4ef7e2.png Captured: 2026-09-15 09:19:37 UTC Source report: https://urlscan.io/result/01a0a45d-49e3-7358-ba27-5528aa4ef7e2/ SHA-256: 85abd1b5201e61f4e43a9f9da2fa9e1530552a3e559d250e3262db8f4d3d98b5 - URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0d735-9a01-749e-8749-6548517ad238.png Captured: 2026-09-25 06:17:01 UTC Source report: https://urlscan.io/result/01a0d735-9a01-749e-8749-6548517ad238/ SHA-256: 85abd1b5201e61f4e43a9f9da2fa9e1530552a3e559d250e3262db8f4d3d98b5 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T03:54:48Z", "uuid": "01a06255-df52-7279-9a0c-8fea3e95d285", "scanned_at": "2026-09-02T13:36:45Z", "final_url": "https://my-new-bnb-bsccoin.surge.sh/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://my-new-bnb-bsccoin.surge.sh/", "from": "http://my-new-bnb-bsccoin.surge.sh/", "status": 307 } ], "ip": "159.203.50.177", "domains": [ "cdn.jsdelivr.net" ], "ips": [ "151.101.1.229", "159.203.50.177" ], "asns": [ "54113", "14061" ], "countries": [ "US", "CA" ], "doc_hash": "b31434a1618bdada40df7eddb8eaa0e285c41308da9e6deeadb5b9af608296e3", "script_hashes": [ "db7098ad289dc91129af82dbc1f9aeb968e58ebfa9bd15bc2398fbc0484a52a4", "2409825c9b7431e1219b4548ce2d0a8151b0056beae88ea468a61d37e380fe0f" ], "globals": [ "_ethers", "ethers", "CONFIG" ], "tls": { "san": [ "*.surge.sh", "surge.sh" ], "cipher": "AES_256_GCM", "issuer": "Sectigo Public Server Authentication CA DV R36", "subject": "*.surge.sh", "protocol": "TLS 1.3", "valid_to": "2026-12-16T23:59:59Z", "valid_from": "2026-06-01T00:00:00Z" }, "domain_age_days": 0, "apex_age_days": 4212, "tls_age_days": 93, "tls_valid_days": 198, "requests": 6, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 58, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Surge", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:35:09Z", "uuid": "5e245293-bc59-4eab-9df5-a6ac71727dc7", "scanned_at": "2026-09-02T14:20:02Z", "final_url": "https://my-new-bnb-bsccoin.surge.sh/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://my-new-bnb-bsccoin.surge.sh/", "status": 307 }, { "url": "https://my-new-bnb-bsccoin.surge.sh/", "status": 200 } ], "dom_hash": "8196279ef06d2b51c0b2db97fbd46a9965ef27986d80539f26b8533939e2ce5d", "doc_hash": "b31434a1618bdada40df7eddb8eaa0e285c41308da9e6deeadb5b9af608296e3", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "my-new-bnb-bsccoin.surge.sh", "type": "A", "value": "46.101.67.123" } ], "dnssec_valid": false, "ip": "46.101.67.123", "whois": { "registrar": "Porkbun LLC", "created": "2014-07-25T23:10:53Z", "updated": "2026-08-11T20:27:40Z", "expires": "2027-07-25T23:10:53Z", "nameservers": [ "ns1.surge.world", "ns2.surge.world", "ns3.surge.world", "ns4.surge.world" ] } } } ```