stellarpayportal[.]online[.]lantrustworld[.]org

This domain, stellarpayportal.online.lantrustworld.org, poses a high-risk threat by impersonating Trust Wallet, a widely used cryptocurrency wallet service. The site is designed to deceive users into entering sensitive credentials, such as recovery phrases or private keys, under the false pretense of providing support or wallet services. Once obtained, these credentials can be used to drain digital assets from victims' wallets, leading to irreversible financial loss. The page title, 'MetaMask Support - Your Web3 Wallet Companion,' further misleads users by blending branding from multiple trusted services, increasing the likelihood of successful deception.

Analysis indicates this domain is actively malicious, with 13 out of 95 security vendors on VirusTotal flagging it as dangerous. The domain was registered on August 20, 2025, through DYNADOT LLC, a registrar frequently associated with newly created malicious infrastructure. It currently resolves to the IP address 198.251.88.188, hosted on AS53667 (FranTech Solutions), an autonomous system known for harboring high-risk domains. The absence of an SSL certificate further signals a lack of basic security measures, which is atypical for legitimate financial or wallet services. Additionally, the domain appears on three security blocklists, including those maintained by cryptocurrency security entities, reinforcing its classification as a brand_impersonation threat.

If a user has visited stellarpayportal.online.lantrustworld.org or interacted with its content, immediate action is required. First, disconnect the device from the internet to prevent potential data exfiltration. Next, revoke any permissions or connections granted to the site within wallet applications or browser extensions. Users should assume any credentials entered on the site are compromised and take steps to secure their accounts, including transferring assets to a new wallet with a fresh recovery phrase. Monitor all linked accounts for unauthorized transactions and report the incident to relevant security teams or platforms. Additionally, scan the device for malware using updated security tools to ensure no persistent threats remain.