sendusdt[.]app

The domain www.sendusdt.app was registered through Tucows Domains Inc. on February 21, 2026 and is presently taken offline. DNS resolution points to the address 80.78.27.86, which maps to an autonomous system AS39287 (Materialism s.r.l.) located in Denmark. The authoritative name servers are 1-you.njalla.no, 2-can.njalla.in and 3-get.njalla.fo, indicating the use of the njalla hosting service. An HTTPS endpoint is present, secured by a Let’s Encrypt certificate issued under the R13 profile, and the server advertises modern transport and security features including Envoy, HSTS, Cloudflare and HTTP/3.

The only visible page title returned by the server is “Just a moment…”, a generic placeholder that does not reveal functional content. A Gridinsoft trust score of 0 / 100 was recorded, reflecting a lack of credibility. VirusTotal analysis shows that 1 of 95 scanners flagged the domain, and the site is listed on a single security blocklist. PhishDestroy has also blocked the domain.

The site explicitly impersonates Trust Wallet and is classified as a wallet/seed phishing campaign, targeting users of the cryptocurrency wallet to harvest private keys or recovery phrases. Although the site is no longer reachable, the underlying infrastructure—particularly the IP address, the njalla name servers, and the Let’s Encrypt certificate—remains observable and could be reused in future malicious deployments. Defenders should add www.sendusdt.app and 80.78.27.86 to network and email filtering rules, monitor for re‑registration of the domain or related subdomains, and watch for any new activity originating from the same name server set or ASN. Continuous threat‑intel feeds should be consulted for any reappearance of the domain or similar Trust Wallet impersonation attempts, and incident response teams should be prepared to educate users about unsolicited requests for wallet seeds or private keys.