trustwalletcards[.]org

PhishDestroy identifies trustwalletcards.org as a live brand-impersonation domain targeting Trust Wallet users for credential and crypto theft. The page hosts a drainer kit that siphons private keys and wallet seeds under the guise of “card verification.” Registrant details show a recently minted domain—created March 30, 2026—registered through Name.com, Inc., and resolving to IPv4 address 64.29.17.65. The site sports a valid Let’s Encrypt SSL certificate to appear legitimate, but its sole purpose is to trick visitors into surrendering sensitive wallet data. Technical indicators confirm elevated risk: VirusTotal reports only 1 out of 95 participating engines currently flagging the domain (1/95), Google Safe Browsing returns no blocklist entry, and the domain has not yet propagated to major threat-intel feeds. Despite the low VT coverage, the drainer payload is fully functional, harvesting mnemonic phrases and private keys via obfuscated JavaScript. Creation date is suspiciously recent—just days ago—indicating an opportunistic campaign timed for maximum victim engagement. Registrar data shows privacy protection enabled, masking the true registrant and complicating takedown efforts. The domain remains active and is actively serving the drainer kit to mobile and desktop visitors. PhishDestroy recommends immediate network-level blocking of 64.29.17.65 and the domain itself at DNS and firewall layers. Users who may have entered seed phrases should immediately transfer remaining assets to a new wallet, revoke any connected smart-contract approvals, and rotate associated email and password credentials. Persistent campaign activity suggests risk will remain elevated until hosting providers and registrars intervene; therefore continuous monitoring and user education are essential to mitigate ongoing theft.