trust-card[.]work

PhishDestroy identifies trust-card.work as a generic phishing domain currently under investigation for credential theft activities. The domain is actively resolving to IP address 188.114.96.3 and uses a Let's Encrypt SSL certificate to establish false trust. While the exact brand being impersonated remains unverified at this stage, the domain's recent creation date—April 03, 2026—and operational status suggest a live campaign designed to harvest sensitive user input under the guise of secure card services. The threat actor leverages a 'drainer kit' framework, a common toolset used in credential phishing operations to mimic legitimate login interfaces and exfiltrate captured data to attacker-controlled servers. This domain should be treated as a high-fidelity threat vector pending further forensic validation.

This domain exhibits several technical indicators consistent with emerging phishing infrastructure. According to VirusTotal analysis conducted under seed fc53ab, trust-card.work currently shows 19 out of 95 detection engines flagging it as malicious—indicating it remains under the radar despite active operation. The domain is registered through NAMECHEAP INC and was registered on April 03, 2026; this unusually recent registration date in combination with active resolution to IP 188.114.96.3 suggests a hastily deployed campaign. Google Safe Browsing (GSB) has not yet blacklisted the domain, and as of current checks, no prominent blocklists have flagged it. The absence of detections highlights the evasive nature of the infrastructure but does not diminish the operational risk it poses to end-users.

As of the latest assessment, trust-card.work remains classified as 'active' with a risk level categorized as 'under_investigation' by PhishDestroy’s threat intelligence pipeline. Immediate defensive actions should include network-level blocking of 188.114.96.3 and domain-wide DNS sinkholing for trust-card.work and any subdomains. Users are strongly advised to avoid entering any credentials or sensitive information into this domain and to report any observed interactions via official channels. While current detection coverage is low, the combination of fresh registration, active resolution, and SSL certification raises significant red flags. PhishDestroy continues to monitor this domain using seed fc53ab and will escalate the classification if further evidence of malicious intent is uncovered. Remaining risk is assessed as moderate to high given the domain’s active status and latent capacity for credential theft.