tw-cardprovid[.]com

The domain tw-cardprovid.com is currently active and engaged in brand impersonation targeting Trust Wallet, a cryptocurrency wallet service. This infrastructure is designed to deceive users into interacting with fraudulent crypto card services, potentially leading to unauthorized asset transfers or credential compromise. The domain remains operational as of the latest verification. Analysis indicates the domain was registered on May 28, 2026, through Cloudflare, Inc., a registrar frequently leveraged for anonymized or malicious infrastructure. It resolves to the IP address 99.83.217.1 and employs a Let's Encrypt SSL certificate, which provides encryption but does not validate legitimacy. The site is built using Node.js, React, Next.js, and Webpack, technologies commonly used in both legitimate and malicious web applications. The page title, 'Trust Wallet - Crypto Card,' directly mimics Trust Wallet's branding. Security vendors have flagged this domain, with 14 of 95 VirusTotal engines detecting malicious activity. Additionally, the domain appears on one security blocklist, further corroborating its suspicious nature. The current risk level is classified as elevated due to the domain's active status, direct impersonation of a trusted cryptocurrency service, and detection by multiple security vendors. Organizations and users are advised to block access to tw-cardprovid.com at the network level and monitor for related domains or IP addresses. End-users should verify the authenticity of any Trust Wallet-related communications by accessing the official website directly and avoiding interaction with unsolicited links or emails. Security teams are encouraged to review logs for connections to 99.83.217.1 and investigate potential exposure to this infrastructure.