walletrust[.]cards

Analysis indicates that the domain walletrust.cards was registered on 21 March 2026 through Name.com, Inc. and is currently active. The site presents a page titled “Trust Wallet”, directly mimicking the legitimate Trust Wallet brand. Its primary classification is brand impersonation aimed at cryptocurrency users, and it has already been added to a security blocklist and flagged by PhishDestroy. The hosting infrastructure resides on Google Cloud, resolving to IP address 34.111.179.208 located in the United States. The domain utilizes four name servers (ns1cny.name.com, ns2ckr.name.com, ns3jkl.name.com, ns4hny.name.com) and serves content over HTTPS with a Let’s Encrypt certificate (E8). HTTP response code 200 is returned, and the site employs HSTS, HTTP/3, Google Cloud Trace, and Google Cloud CDN, confirming modern web stack deployment. VirusTotal scans have returned 13 positive detections out of 95 security vendors, and the Gridinsoft trust score is 0 out of 100, reinforcing the high‑risk assessment. The site’s content is tailored to lure cryptocurrency wallet users, likely to harvest private keys or credentials. While the exact phishing page mechanics are not disclosed, the presence of a brand‑consistent title and the use of reputable cloud services suggest a sophisticated approach to evade casual detection. Defenders should add walletrust.cards to blocklists at network and endpoint layers, enforce DNS filtering, and monitor outbound connections to the associated Google Cloud IP range. Incident response teams should advise users of Trust Wallet to verify URLs and refrain from entering credentials on any site that does not match the official domain. Continuous monitoring of newly created domains targeting the Trust Wallet brand is recommended to capture similar campaigns early.