trustwalletssupports[.]netlify[.]app

This domain is flagged as a high-risk credential harvesting site targeting users of Trust Wallet, a cryptocurrency wallet service. The site presents a fraudulent interface mimicking Trust Wallet’s import options page, designed to trick visitors into entering sensitive recovery phrases or private keys. Once submitted, these credentials are transmitted to threat actors, enabling unauthorized access to victims’ cryptocurrency holdings. The page title, 'Trust Wallet - Import Options,' directly aligns with the legitimate Trust Wallet workflow, increasing the likelihood of successful deception, particularly among users attempting to recover or migrate their wallets. Analysis indicates the domain was registered through Netlify on March 22, 2026, though this date may reflect a falsified record or a misconfiguration, as it predates the current year. Infrastructure analysis reveals the site resolves to IP address 63.176.8.218, hosted on AWS EC2 in the eu-central-1 region. The SSL certificate, issued by DigiCert Inc under the 'DigiCert Global G2 TLS RSA SHA256 2020 CA1' chain, provides a false sense of security to visitors. As of the latest scan, 5 out of 95 security vendors on VirusTotal have flagged the domain as malicious, and it appears on three independent security blocklists. The domain remains active and unmitigated, posing an ongoing threat to unsuspecting users. If a user has visited trustwalletssupports.netlify.app and entered any sensitive information, immediate action is required to mitigate potential financial loss. First, cease all interaction with the site and disconnect the device from the internet to prevent further data exfiltration. Next, transfer all cryptocurrency assets from the compromised wallet to a new, secure wallet using a different device. Ensure the new wallet is initialized with a fresh recovery phrase, never reused from the compromised account. Monitor the original wallet for unauthorized transactions and report the incident to relevant cryptocurrency exchanges or platforms. Additionally, scan the device for malware using updated security tools, as phishing sites may deploy secondary payloads. Users should also enable multi-factor authentication on all related accounts and consider revoking any connected API keys or permissions. Awareness of this domain’s indicators of compromise, such as its IP address and SSL certificate details, can aid in preventing future exposure.