mytrustvalidator[.]com

mytrustvalidator.com was registered on 19 January 2025 through Global Domain Group LLC. The domain resolves to the IPv4 address 198.251.89.144, which is announced by AS53667 (FranTech Solutions) and geolocated to the United States. Authoritative nameservers ns15.asurahosting.com and ns16.asurahosting.com serve the zone. An HTTP request to the host returns a page with the title "Mytrustvalidator — Building Bridges to Decentralization". The site runs Microsoft ASP.NET on the Kestrel web server, but no TLS certificate is presented, indicating the service is delivered over plain HTTP.

VirusTotal analysis shows that 12 of 95 scanning engines flagged the domain as malicious, consistent with its classification as a wallet/seed phishing campaign targeting Metamask users. The domain is listed on four public security blocklists and has been actively blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. Additional intelligence from AlienVault OTX includes a single pulse referencing the same indicator. The campaign’s primary objective is to harvest cryptocurrency wallet seeds by masquerading as a trusted service, as indicated by the "wallet/seed phishing" tag and the explicit impersonation of the Metamask brand.

At the time of reporting (23 July 2026) the site is taken offline, but the underlying infrastructure—particularly the IP address and nameserver configuration—remains observable and could be reused for future malicious deployments. Defenders should continue to deny network traffic to 198.251.89.144, enforce DNS blocking of mytrustvalidator.com and its associated nameservers, and monitor related ASN traffic for repeat activity. Adding the indicator to internal blocklists and sharing the evidence with upstream threat‑sharing communities will reduce the likelihood of successful credential harvesting against Metamask users.