app[.]trias0ne[.]xyz

Analysis of app.trias0ne.xyz indicates that the domain was registered on February 21, 2026 and is currently taken offline. The site presented the page title “Trias | Link the world with trust,” which aligns with a wallet/seed phishing campaign targeting users of the Trias brand. Gridinsoft assigned a trust score of 0 out of 100, confirming the malicious nature of the content. VirusTotal recorded a single positive detection out of 93 scanning engines, reinforcing the suspicion despite the low detection count.

The SSL certificate is identified as “R11,” a common indicator of self‑signed or low‑trust certificates used in fraudulent sites. The domain appears on one security blocklist and has been actively blocked by PhishDestroy, demonstrating that at least one external sinkhole has responded to the threat. The threat category is listed as brand impersonation with a specific focus on wallet and seed credential harvesting. Defenders should add app.trias0ne.xyz to deny‑list rules across perimeter firewalls, DNS filtering and web proxy solutions, and confirm that any existing allow‑list entries are removed.

Monitoring of newly registered domains that share the “trias0ne.xyz” suffix or similar naming patterns is advised, as the attacker may reuse the same infrastructure. Incident response teams should treat any alerts related to credential submission to this domain as compromised and advise affected users to rotate wallet seeds or private keys immediately. Continuous review of threat intelligence feeds for additional indicators related to this campaign is recommended.