primetrustwallet[.]com[.]soundvests[.]com

This domain, primetrustwallet.com.soundvests.com, is identified as a confirmed credential harvesting and wallet seed phrase capture site targeting users of Trust Wallet, a widely used cryptocurrency wallet service. Analysis indicates the domain is designed to deceive victims into entering sensitive authentication credentials, including private keys and recovery phrases, under the guise of legitimate Trust Wallet operations. The threat type is classified as brand impersonation with a high-risk assessment due to its direct targeting of financial assets and personal security credentials. Infrastructure analysis reveals multiple technical indicators supporting this classification. The domain was registered on April 29, 2026, through TuringSign Inc. d/b/a Cosmotown and currently resolves to the IP address 198.251.88.6, hosted by FranTech Solutions in Luxembourg. It appears on three independent security blocklists and is flagged by 10 of 95 security vendors on VirusTotal, including confirmed detections by PhishDestroy, MetaMask, and SEAL. Google Safe Browsing has explicitly marked the domain as phishing. The SSL certificate is issued by Let's Encrypt (R12), a common tactic used to create a false sense of legitimacy while concealing malicious intent. As of the latest verification, primetrustwallet.com.soundvests.com has been taken offline, reducing immediate exposure risk. However, the domain registration remains active, and similar infrastructure may be reused for future attacks. Users who accessed the site prior to its takedown should immediately revoke any entered credentials, transfer assets to new wallet addresses, and monitor for unauthorized transactions. Organizations are advised to block the domain and associated IP at the network level and update endpoint protection rules to include this indicator of compromise. Continuous monitoring of newly registered domains under similar subdomain structures is recommended to preempt further impersonation attempts.