trustwalletcards[.]shop

The domain trustwalletcards.shop is presently active and resolves to the IP address 162.252.198.162. Its authoritative name servers are dns1.regway.com, dns2.regway.com, dns3.regway.com, and dns4.regway.com, indicating registration through the RegWay DNS service. The domain has been flagged by multiple security vendors: four of ninety‑five VirusTotal scanners have identified it as malicious, and it is listed on three external blocklists.

Defensive products such as PhishDestroy, MetaMask, and SEAL have already added the domain to their block lists, suggesting that the site is being used to target cryptocurrency users, consistent with its classification as a crypto drainer. No public information is available regarding the site’s SSL certificate, HTTP response codes, or page title, and no additional intelligence on the hosting provider, ASN, or geographic location has been disclosed. Because the domain is actively resolving and is already recognized by major anti‑phishing and wallet protection tools, defenders should continue to block any traffic to trustwalletcards.shop at network perimeter and endpoint layers.

Security teams should also monitor the associated IP address 162.252.198.162 for any new malicious activity, and consider adding the host to internal threat intelligence feeds. Ongoing observation of DNS changes for the listed RegWay name servers is recommended, as any alteration may indicate a shift in infrastructure. The limited detection footprint—four vendor flags and three blocklist entries—highlights the need for rapid containment while additional analysis, such as content retrieval and certificate inspection, is performed to fully characterize the threat vector.