usewallet[.]app

This domain, usewallet.app, presents a high-risk brand impersonation threat specifically targeting users of Trust Wallet, a widely utilized cryptocurrency wallet service. The fraudulent site mimics the legitimate Trust Wallet interface, displaying the page title 'Trust Wallet - Crypto Card' to deceive visitors into entering sensitive credentials or authorizing malicious transactions. Analysis indicates the domain is designed to facilitate cryptocurrency theft, likely through a crypto drainer mechanism, where unauthorized transactions are executed to siphon digital assets from victims' wallets. The inclusion of tracking technologies such as Facebook Pixel suggests an intent to profile and target users based on behavioral data, increasing the sophistication of the attack. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification of usewallet.app. The domain was registered on April 26, 2026, through TLD Registrar Solutions Ltd, a registrar frequently associated with high-risk domains. It resolves to the IP address 216.198.79.1 and is flagged by 13 out of 95 security vendors on VirusTotal, with detections from reputable sources including MetaMask, PhishDestroy, and SEAL. Additionally, the domain appears on three security blocklists, further corroborating its malicious nature. The site employs Vercel for hosting and jsDelivr for content delivery, while implementing HSTS and a Let's Encrypt SSL certificate to create a false sense of legitimacy. Users who have visited usewallet.app or interacted with its content are advised to take immediate action to mitigate potential risks. First, revoke any suspicious wallet authorizations or connected applications through the legitimate Trust Wallet interface. Next, monitor all linked cryptocurrency wallets for unauthorized transactions and transfer remaining assets to a new, secure wallet if compromise is suspected. It is also recommended to scan the device used to access the domain for malware, as phishing sites may deploy additional payloads. Finally, report the domain to relevant security communities and blocklists to prevent further exploitation of other users.