p-trustwallet-cards-fdea5de5[.]prov[.]cx

Analysis of the domain p‑trustwallet‑cards‑fdea5de5.prov.cx indicates active infrastructure associated with a high‑risk crypto drainer campaign. The domain was registered through CentralNic Ltd on 7 July 2026 and is served by the authoritative name servers dns1.icedns.is and dns2.icedns.is. DNS resolution points to the IPv4 address 79.124.58.150, which remains reachable as of the reporting date. Google Safe Browsing classifies the host under the SOCIAL_ENGINEERING category, confirming its use for deceptive activities. VirusTotal records show that the domain has been scanned by 91 security vendors, none of which currently raise a detection; this absence of alerts does not imply benign intent given the corroborating evidence. The short lifespan, recent creation, and alignment with the crypto drainer threat model suggest that the site is being used to lure victims into transferring cryptocurrency assets to attacker‑controlled wallets. Defenders should consider adding the domain and its resolving IP to block lists, monitor network traffic for connections to the address, and enforce strict outbound controls for cryptocurrency transactions. Continuous re‑evaluation is advised, as the infrastructure may evolve or additional indicators may emerge.