trust-receive-money[.]icu

trust-receive-money.icu was registered through Web Commerce Communications Limited dba WebNic.cc and created on 21 February 2026. The domain resolves to IP address 31.57.61.95, which is hosted in Finland and belongs to ASN 56971 (Cloud). Authoritative nameservers ns100.webnic.cc and ns101.webnic.cc serve the zone. The presented SSL certificate is identified as R11, indicating a self‑signed or low‑trust certificate.

HTTP requests to the domain return a status of offline at the time of analysis, and the site has been taken down by the blocklist operator PhishDestroy. VirusTotal reports five of ninety‑three scanning engines flagging the domain, reflecting a low but non‑zero detection rate. The domain is listed on a single security blocklist, and external reputation services assign extremely low scores: Gridinsoft 0/100 and Scamadviser 1/100. The page title returned from the site is “Wallet Connect”, and the campaign is classified as a wallet/seed phishing operation that impersonates the Ethereum brand.

No additional forensic artifacts such as JavaScript kits or redirect chains are available in the current intelligence set. The limited detection footprint and the offline status suggest that the infrastructure was short‑lived, but the presence of a dedicated registrar and a cloud‑based IP indicate a purposeful setup. Defenders should continue to monitor the IP address 31.57.61.95 and the associated ASN for any re‑use, add the domain to internal blocklists, and ensure that endpoint protection solutions are updated to reflect the five VirusTotal detections. Because the domain is already offline, active takedown actions are not required, but threat‑intel sharing with peers is recommended to prevent future impersonation attempts targeting Ethereum users.