heartfelt-donut-841c0a[.]netlify[.]app

This domain is flagged as a high-risk brand impersonation threat specifically targeting Trust Wallet users. The page title, 'Transfer Trust Wallet,' suggests an attempt to deceive victims into interacting with fraudulent wallet transfer mechanisms, likely designed to extract cryptocurrency credentials or private keys. Analysis indicates the domain is actively used in ongoing campaigns to exploit users of the targeted wallet service. Infrastructure analysis reveals the domain resolves to the IP address 63.176.8.218 and is registered through Netlify, a platform commonly abused for hosting malicious content due to its ease of deployment. VirusTotal detection metrics show 6 out of 95 security vendors have flagged the domain as malicious, while it appears on two independent security blocklists: PhishDestroy and ScamSniffer. The SSL certificate is issued by DigiCert Inc under the 'DigiCert Global G2 TLS RSA SHA256 2020 CA1' chain, which does not mitigate the domain's malicious intent. No legitimate creation date or historical context is available, reinforcing the likelihood of recent malicious deployment. Mitigation steps for this threat type include immediate blocking of the domain and its resolving IP at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to the domain, particularly on systems used for cryptocurrency transactions. Users should be educated to verify wallet interfaces by cross-referencing official URLs and enabling multi-factor authentication where available. Cryptocurrency wallet providers are advised to monitor for unauthorized access attempts linked to this domain and issue warnings to users about ongoing impersonation campaigns. Network logs should be reviewed for prior connections to 63.176.8.218 or heartfelt-donut-841c0a.netlify.app to identify potential compromise.