holder-trust-wallet[.]com

This domain, holder-trust-wallet.com, poses a targeted credential harvesting threat against users of the Trust Wallet cryptocurrency platform. Analysis indicates the infrastructure was specifically designed to mimic legitimate Trust Wallet interfaces, likely through cloned login pages or fake wallet recovery prompts. The objective appears to be the unauthorized collection of wallet credentials, seed phrases, or private keys, which could lead to immediate asset theft from connected blockchain accounts. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on April 08, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3. Security vendor detection on VirusTotal shows 8 out of 95 engines flagging the domain as malicious, while it appears on three independent security blocklists. The domain has been actively blocked by at least three cryptocurrency security platforms, and its Gridinsoft trust score is 0 out of 100. The SSL certificate is issued by Let's Encrypt, a common tactic to lend false legitimacy to phishing sites. Users who visited holder-trust-wallet.com should assume credential exposure and take immediate corrective action. Any entered wallet credentials, seed phrases, or private keys must be considered compromised. Affected users should transfer assets to a new, secure wallet using a clean device, revoke any connected dApp permissions, and monitor transaction histories for unauthorized activity. The domain has been taken offline, but users should verify they did not download or install any files from the site, as these may contain persistent malware. Future vigilance is advised, as similar impersonation domains may emerge using comparable naming conventions.