trustwalletpay9[.]cyou

This domain, trustwalletpay9.cyou, is flagged as a high-risk credential harvesting operation targeting users of Trust Wallet, a cryptocurrency wallet service. Analysis indicates the infrastructure is designed to impersonate the official Trust Wallet login interface, likely to capture sensitive credentials such as recovery phrases, private keys, or wallet passwords. The page title, Smartlab dev | Login, suggests the use of a generic or repurposed development template, which is a common tactic in phishing campaigns to obscure the malicious intent behind seemingly legitimate login portals.

Technical indicators reveal the domain was registered on February 21, 2026, through Cosmotown Inc, a registrar frequently associated with abusive registrations. The domain resolves to IP address 14.128.14.32, hosted on AS136246 (Tomattos Technologies Ltd.) in Bangladesh. VirusTotal reports 10 out of 95 security vendors flagging the domain as malicious, while it appears on three distinct security blocklists. The infrastructure lacks an SSL certificate, which is atypical for legitimate financial or cryptocurrency services and further corroborates the malicious classification. No Google Safe Browsing (GSB) detection is noted in the provided intelligence, though this may reflect a lag in reporting rather than an absence of risk.

As of the latest intelligence, trustwalletpay9.cyou has been taken offline, likely in response to detection and reporting by security entities. However, the remaining risk persists due to the potential for the operators to redeploy the infrastructure under a new domain or IP address. Users who may have interacted with this domain are advised to immediately revoke any exposed credentials, monitor associated wallet addresses for unauthorized transactions, and verify the authenticity of any communications purporting to be from Trust Wallet. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.