trust-cards[.]biz

This domain, trust-cards.biz, is actively engaged in crypto wallet drainer phishing operations targeting users of digital asset platforms. Analysis indicates the site is designed to mimic legitimate cryptocurrency services, tricking visitors into connecting their wallets to malicious smart contracts that automatically siphon funds. The page title 'paycrypt' and the presence of tracking technologies like Facebook Pixel suggest an attempt to monitor and optimize user interactions for fraudulent purposes, while the use of Cloudflare infrastructure obscures the true origin of the attack. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain resolves to IP address 104.21.4.52, which is proxied through Cloudflare, a common tactic to evade detection and takedown efforts. It is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. As of the latest scan, 15 out of 95 security vendors on VirusTotal flag this domain as malicious, and it appears on at least one security blocklist. The domain employs HTTP/3 and Cloudflare Browser Insights, further indicating an attempt to appear legitimate while maintaining operational security. Users who have visited trust-cards.biz or interacted with its content should take immediate action to mitigate potential financial loss. Disconnect any wallets that may have been linked to the site and revoke permissions for all suspicious smart contracts using tools like Etherscan or BscScan. Monitor wallet activity for unauthorized transactions and consider transferring assets to a new, secure wallet if any compromise is suspected. Additionally, scan all devices used to access the site for malware, as phishing pages may deploy additional payloads. Report the domain to relevant security teams and cryptocurrency platforms to aid in broader mitigation efforts.