trustagestablecoin-login[.]com

This domain, trustagestablecoin-login.com, is an active credential phishing site targeting users of a stablecoin platform. Analysis indicates the threat type is credential harvesting, where victims are tricked into entering login credentials on a fraudulent interface designed to mimic legitimate cryptocurrency services. The domain remains operational as of the latest assessment, posing an immediate risk to unsuspecting users. Infrastructure analysis reveals several critical indicators. The domain was registered on May 28, 2026, through MarkMonitor, Inc., a registrar commonly associated with legitimate brands but exploited in this case for malicious purposes. It resolves to IP address 3.33.139.32, hosted on Amazon Web Services (AS16509) in the United States. Notably, the domain lacks an SSL certificate, a red flag for phishing activity. Security vendors have flagged this domain, with 1 of 95 VirusTotal engines detecting it as malicious. Additionally, it appears on three security blocklists, further confirming its malicious nature. The page title, 'Registered & Protected by Markmonitor,' attempts to lend false legitimacy by mimicking brand protection services. Current status indicates the domain is still active, continuing to pose a threat to users. Organizations and individuals are advised to block access to this domain at the network level and implement DNS-based filtering to prevent user interaction. End-users should be educated on recognizing phishing indicators, such as missing SSL certificates and suspicious domain registration details. Monitoring for similar domains registered through MarkMonitor or hosted on cloud infrastructure is recommended to mitigate future risks associated with this threat actor.