trustwalletfixs[.]web[.]app

This domain, trustwalletfixs.web.app, is a phishing site designed to impersonate Trust Wallet, a legitimate cryptocurrency wallet service. The site presents itself as a recovery or support page, tricking users into entering sensitive credentials such as wallet recovery phrases, private keys, or login details. Once submitted, this information is harvested by threat actors, enabling them to gain unauthorized access to victims' cryptocurrency wallets and drain funds. The site specifically targets users searching for wallet recovery options, exploiting urgency and trust in the brand to facilitate theft. Analysis indicates the domain was registered through Google Firebase, a legitimate hosting service often abused for phishing due to its free tier and SSL certificates. The site resolves to the IP address 199.36.158.100, located in the United States under AS54113 (Fastly, Inc.). The SSL certificate is issued by Google Trust Services (WR4), adding a false sense of legitimacy. As of the latest scan, the domain is flagged by 9 out of 95 security vendors on VirusTotal, confirming its malicious nature. The page title, https://index.html, is a non-standard and suspicious indicator, often used in hastily constructed phishing pages to mimic directory listings or support portals. If you visited trustwalletfixs.web.app and entered any credentials or recovery phrases, immediate action is required. First, disconnect the device used to access the site from the internet to prevent further data exfiltration. Next, transfer any remaining funds from the compromised wallet to a new, secure wallet with a fresh recovery phrase. Do not reuse passwords or recovery phrases from the compromised account. Monitor the original wallet for unauthorized transactions and report the incident to the legitimate Trust Wallet support team for further guidance. Additionally, scan the device for malware using updated security tools to ensure no backdoors or keyloggers were installed. Finally, consider enabling multi-factor authentication on all cryptocurrency-related accounts to add an extra layer of security.