trustwallet-nsd[.]com

This domain, trustwallet-nsd.com, operates as a fraudulent replica of the official Trust Wallet platform, designed to harvest cryptocurrency seed phrases and private keys from unsuspecting users. The site mimics legitimate wallet setup processes, presenting users with fake interfaces that prompt the entry of sensitive recovery information. Once submitted, this data is transmitted to threat actors, enabling immediate unauthorized access to victims' digital assets. The page title, displayed in Chinese as "网站搭建中" (website under construction), serves as a deceptive cover while the backend actively captures credentials, demonstrating a deliberate attempt to exploit users during what appears to be routine wallet initialization. Analysis indicates this domain was registered on November 22, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. The infrastructure resolves to the IP address 45.205.7.5, hosted by Fastnet Data INC in the United States, a provider commonly linked to malicious activity. Security vendors have flagged the domain in 17 out of 95 scans on VirusTotal, with additional detections across three independent blocklists. The SSL certificate, issued by Let's Encrypt (R12), while providing basic encryption, does not validate legitimacy, as fraudulent sites routinely use free certificates to appear trustworthy. The domain's rapid inclusion on security platforms underscores its immediate threat classification. Users who visited trustwallet-nsd.com or entered any recovery phrases on the site should assume their credentials have been compromised. Immediate action is required: transfer all assets to a new, secure wallet using a fresh seed phrase generated offline. Avoid reusing old passwords or recovery phrases, and monitor all linked accounts for unauthorized transactions. If the compromised wallet contained significant funds, consider reporting the incident to relevant blockchain analysis teams for potential tracing. To prevent future exposure, verify domain authenticity by cross-referencing official sources and employ hardware wallets for sensitive operations. This domain's infrastructure and rapid detection by security systems highlight the persistent risk of brand impersonation in the cryptocurrency space.