card-apply-trustwallet[.]com

This domain, card-apply-trustwallet.com, is actively impersonating Trust Wallet as part of a high-risk brand impersonation campaign. Registered on May 20, 2026, through NameCrane LLC, the domain resolves to the IP address 216.252.233.9, hosted by THC Servers Global, LLC in the Netherlands. Infrastructure analysis reveals the use of four nameservers: ns1.thcservers.com, ns2.thcservers.com, ns3.thcservers.com, and ns4.thcservers.com. The domain currently returns an HTTP 302 redirect status, a technique often employed to obscure the final destination or evade detection during initial scans. The page title, 'TrustCard - The Future of Credit Cards,' suggests an attempt to deceive users into believing the site offers a legitimate financial product associated with Trust Wallet. The domain holds a Gridinsoft trust score of 0/100 and is flagged by six out of ninety-five security vendors on VirusTotal, indicating broad recognition of its malicious nature. Additionally, it appears on three security blocklists and has been documented in one AlienVault OTX threat intelligence pulse. The SSL certificate, issued by Let's Encrypt (R13), is consistent with those used in both legitimate and malicious sites, providing no definitive indication of intent on its own. Defenders should treat this domain as an active threat targeting Trust Wallet users. The combination of brand impersonation, recent registration, and low reputation scores aligns with known phishing tactics. Network-level blocking of the domain and its resolving IP (216.252.233.9) is recommended to prevent user interaction. Security teams should also monitor for related domains registered through NameCrane LLC or utilizing THC Servers nameservers, as these may indicate further campaign expansion. While the exact phishing kit or payload remains unconfirmed, the domain's structure and behavior strongly suggest credential harvesting or fraudulent transaction facilitation.