# PhishDestroy domain threat record: usd-bsccoins.surge.sh Content language: English Canonical HTML report: https://phishdestroy.io/domain/usd-bsccoins.surge.sh/ Machine-readable companion: https://phishdestroy.io/domain/usd-bsccoins.surge.sh/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-01 19:47:24 UTC - Last availability or vendor check: 2026-10-21 01:37:29 UTC - Stored record updated: 2026-10-22 14:24:51 UTC - VirusTotal detections in the stored snapshot: 3/92 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: ScamSniffer - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Trust Wallet ## Stored infrastructure - Observed IP address: 159.203.50.177 - Registrar in stored WHOIS data: Surge.sh - Last stored HTTP status: 451 - Registration date (registry RDAP, surge.sh): 2014-07-25 23:10:53 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a05e81-c778-7118-a0d8-4527f8997c4a/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/usd-bsccoins.surge.sh - Certificate Transparency search: https://crt.sh/?q=%25.usd-bsccoins.surge.sh - Web Archive lookup: https://web.archive.org/web/*/https://usd-bsccoins.surge.sh/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview usd-bsccoins.surge.sh poses as Trust Wallet behind a page titled "Transfer Trust Wallet". It is aimed at people who hold or expect to receive tokens in Trust Wallet. The subdomain name pairs "usd" with "bsccoins", which suggests stablecoin or BNB Smart Chain transfers. PhishDestroy first flagged it on 2026-09-01, and it was still online and serving its phishing content on 2026-10-19. How the scam works A "transfer" page that imitates a wallet brand usually tells the visitor that funds are waiting or that a transfer has to be confirmed. It then asks the victim to finish the step by typing in their recovery phrase or by connecting and signing in their wallet. Trust Wallet never asks for a seed phrase on a website. Anyone who types those 12 or 24 words hands over full control of the wallet, and the attacker can empty it from any device. If the victim signs a transaction or token approval instead, the attacker can move the approved assets out without any further action from the victim. Evidence On 2026-10-16, only 3 of 92 VirusTotal engines flagged the site: alphaMountain.ai, Fortinet and Gridinsoft. That low count means most security tools and browsers will let it load with no warning. Two crypto-focused blocklists, PhishDestroy and ScamSniffer, list it, so wallet extensions and integrations that use those feeds can block it. Infrastructure The page runs on Surge.sh, a static-site hosting platform that lets anyone publish a subdomain in seconds without registering a domain. That makes it cheap to launch these pages and easy to replace them. The traffic resolves to DigitalOcean, LLC servers in Canada. The site has a Sectigo domain-validated certificate, so the browser padlock appears, but that padlock does not show who operates the page or whether it is legitimate. What to do If you entered your recovery phrase on this page, treat the wallet as compromised. Create a new wallet with a new phrase on a trusted device, then move any remaining assets to it right away. If you connected a wallet or signed something, check your token approvals for every address you used and revoke any you do not recognize. Real Trust Wallet transfers happen inside the app, never on a website that asks you to "confirm" them. Defenders should block the full hostname at DNS and proxy level, add it to wallet and browser filters, and report it to Surge.sh so the subdomain can be taken down. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a05e81-c778-7118-a0d8-4527f8997c4a/ VirusTotal report: https://www.virustotal.com/gui/domain/usd-bsccoins.surge.sh Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=usd-bsccoins.surge.sh Archived copy: https://web.archive.org/web/20260916200359/https://usd-bsccoins.surge.sh/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:52:10 UTC ## Stored page captures - Primary capture: https://i.ibb.co/GftpqRqY/ea353240e52a.png Captured: 2026-09-01 19:47:24 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a05e81-c778-7118-a0d8-4527f8997c4a.png Captured: 2026-09-01 19:47:24 UTC Source report: https://urlscan.io/result/01a05e81-c778-7118-a0d8-4527f8997c4a/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T03:55:31Z", "uuid": "01a05e81-c778-7118-a0d8-4527f8997c4a", "scanned_at": "2026-09-01T19:46:04Z", "final_url": "https://usd-bsccoins.surge.sh/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://usd-bsccoins.surge.sh/", "from": "http://usd-bsccoins.surge.sh/", "status": 307 } ], "ip": "188.166.132.94", "domains": [ "cdn.jsdelivr.net" ], "ips": [ "104.17.208.5", "188.166.132.94" ], "asns": [ "13335", "14061" ], "countries": [ "NL" ], "doc_hash": "1e1671ba413095a432a33a1fcb626a7cad20197f3f5e134636156f7c75158042", "script_hashes": [ "f6ac7b8762fe4523348a9a667427454ff5aa321e243918376dfcd93c6b6fcb39", "2628ae6ea91dd8abf5cdfea0b0305fbab235b17c68dcfa2c9b5f4403f38fae5f" ], "globals": [ "_ethers", "ethers", "CONFIG" ], "tls": { "san": [ "*.surge.sh", "surge.sh" ], "cipher": "AES_256_GCM", "issuer": "Sectigo Public Server Authentication CA DV R36", "subject": "*.surge.sh", "protocol": "TLS 1.3", "valid_to": "2026-12-16T23:59:59Z", "valid_from": "2026-06-01T00:00:00Z" }, "domain_age_days": 0, "apex_age_days": 4211, "tls_age_days": 92, "tls_valid_days": 198, "requests": 6, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 42, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Surge", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:35:36Z", "uuid": "7bdbaa5e-bf2e-4749-b370-1f61f2b6898b", "scanned_at": "2026-09-01T20:01:54Z", "final_url": "https://usd-bsccoins.surge.sh/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://usd-bsccoins.surge.sh/", "status": 307 }, { "url": "https://usd-bsccoins.surge.sh/", "status": 200 } ], "dom_hash": "8196279ef06d2b51c0b2db97fbd46a9965ef27986d80539f26b8533939e2ce5d", "doc_hash": "1e1671ba413095a432a33a1fcb626a7cad20197f3f5e134636156f7c75158042", "phishing_v2": [ "phishing" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "usd-bsccoins.surge.sh", "type": "A", "value": "159.203.50.177" } ], "dnssec_valid": false, "ip": "159.203.50.177", "whois": { "registrar": "Porkbun LLC", "created": "2014-07-25T23:10:53Z", "updated": "2026-08-11T20:27:40Z", "expires": "2027-07-25T23:10:53Z", "nameservers": [ "ns1.surge.world", "ns2.surge.world", "ns3.surge.world", "ns4.surge.world" ] } } } ```