mail[.]payment-usdc-erc20[.]com

Analysis of mail.payment-usdc-erc20.com indicates an active high‑risk brand impersonation campaign targeting TrustWallet users. The domain was registered on April 25, 2026 and resolves to IP 159.100.6.19, an address located in Germany under AS214036 owned by Ultahost, Inc. The hosting environment runs LiteSpeed with HTTP/3 support, and the site presents a valid Let’s Encrypt certificate (R13). DNS resolution uses four Ultahost nameservers (ns1‑ns4.ultahost.com). The HTTP response returns status 200 and the page title is "Trust Wallet," matching the advertised brand target. The domain is already blocked by PhishDestroy and appears on one external blocklist; VirusTotal scans show 10 of 91 security vendors flagging the host, while Gridinsoft assigns a trust score of 0/100, reinforcing the malicious classification. No content analysis is available beyond the title, so the exact phishing mechanics, credential‑stealing forms, or payload delivery methods remain unknown. Defenders should immediately block the domain at network perimeters and email gateways, add the IP address to threat intelligence feeds, and monitor for outbound connections to 159.100.6.19. Continued observation of DNS queries for the Ultahost nameservers is advisable, as further malicious subdomains may be launched from the same infrastructure. Organizations that rely on TrustWallet should enforce multi‑factor authentication, educate users about unsolicited wallet communications, and consider pre‑emptive URL filtering for any URLs containing "payment-usdc-erc20" or similar patterns.