trustpaycard[.]vip

Analysis of trustpaycard.vip (registered 2026-03-06 via Dynadot LLC) shows a confirmed generic phishing infrastructure that is currently offline. The domain resolves to IP 196.251.107.10, which is announced by AS214351 belonging to FEMO IT SOLUTIONS LIMITED in Germany. Both authoritative name servers are ns1.dyna-ns.net and ns2.dyna-ns.net, indicating continued use of Dynadot’s default DNS service. The site presented an SSL certificate issued by Let’s Encrypt (certificate identifier E7), confirming the use of a free TLS provider. HTTP metadata revealed a page title of “Trust”, and server headers identified Nginx as the web server.

Client‑side components include the Smartsupp live‑chat widget and a Facebook Pixel, both typical of tracking or social‑engineering pages. The domain scored 0 out of 100 on the Gridinsoft trust‑score metric, reflecting a lack of reputable reputation. It is listed on three public security blocklists and has been actively blocked by the PhishDestroy, MetaMask, and SEAL filtering platforms. VirusTotal submitted the site to 95 scanners; one vendor flagged it as malicious, providing independent confirmation of its abusive nature. The combination of a recent registration, low trust score, presence on multiple blocklists, and active blocking by anti‑phishing services evidences that trustpaycard.vip was being used for credential‑harvesting or fraudulent payment collection.

No additional content analysis is available because the site is offline, and the page content beyond the title has not been captured. Defenders should continue to enforce blocklist rules for the domain and its IP address, update proxy and firewall policies to deny traffic to 196.251.107.10, and monitor for any re‑registration attempts or similar domains using the same naming pattern. Ongoing observation of the associated ASN and the Dynadot name servers is advised, as threat actors often recycle infrastructure.