ha138[.]com

The domain ha138.com is identified as a brand impersonation threat specifically targeting Trust Wallet, a cryptocurrency wallet service. Analysis confirms this domain was designed to deceive users into believing they are interacting with legitimate Trust Wallet infrastructure, likely to facilitate unauthorized transactions or credential harvesting. The domain is currently offline, though prior activity suggests it operated as part of a broader crypto-draining scheme. Infrastructure analysis reveals ha138.com was registered through NameCheap, Inc. on November 15, 2025, and resolved to the IP address 47.76.197.103. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0 out of 100, indicating high-risk classification. VirusTotal reports that 4 of 95 security vendors flagged this domain as malicious. The page title, 'HX.DUSelflessColorUSDTBlockchainDecentralizedGame,' suggests an attempt to mimic blockchain or decentralized finance (DeFi) terminology to lend credibility to the fraudulent operation. Detected technologies include Vue.js for dynamic content rendering and HTTP Strict Transport Security (HSTS), while the SSL certificate was issued by Let’s Encrypt, a common tactic to evade basic security warnings. The domain’s current offline status does not eliminate the risk, as threat actors frequently reactivate or repurpose infrastructure. Organizations and individuals are advised to block ha138.com and its associated IP (47.76.197.103) at the network level. End users should verify wallet addresses independently before transactions and avoid interacting with unsolicited links or communications claiming to represent Trust Wallet. Security teams should monitor for related domains registered via NameCheap or resolving to the same IP range, as these may indicate follow-up campaigns. Cryptocurrency users are further cautioned to enable multi-factor authentication and review transaction histories for unauthorized activity.