trustheritage[.]live

This domain is flagged as a cryptocurrency wallet phishing site designed to harvest sensitive credentials from users under the guise of private browsing. Analysis indicates the domain employs deceptive tactics, including a page title of 'about:privatebrowsing,' to simulate a secure or anonymous browsing environment, which is atypical for legitimate services. The intent is to trick users into entering wallet recovery phrases, private keys, or login details, leading to unauthorized fund transfers or account takeovers. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Dynadot LLC, an uncommon registrar for legitimate cryptocurrency services. It resolves to the IP address 198.251.89.30 and is blocked by 4 security blocklists, including cryptocurrency-specific threat intelligence sources. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious, with a Gridinsoft trust score of 0/100. Technologies detected include LiteSpeed and HTTP/3, which are not inherently malicious but are frequently leveraged in phishing campaigns for their performance and evasion capabilities. Users who visited trustheritage.live should immediately cease all interactions and assume their credentials or recovery phrases may be compromised. If any sensitive information was entered, affected users must transfer remaining funds to a new, secure wallet and revoke access to any connected applications or services. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to relevant cryptocurrency platforms and security teams to aid in mitigating further risks. The domain is currently offline, but threat actors may re-establish it under a different name or IP address.