eth30[.]vip

This domain, eth30.vip, is flagged as a brand impersonation threat designed to deceive users of Trust Wallet, a popular cryptocurrency wallet service. The site presents itself as a reward portal, using the title 'REWARD Portal v2 | Latest Web3 Wallets,' to lure victims into interacting with malicious content. Such impersonation schemes typically aim to harvest sensitive information, such as private keys or seed phrases, or trick users into executing transactions that drain their crypto assets. The risk is particularly elevated for individuals expecting legitimate promotions or airdrops, as the site exploits trust in the targeted brand to facilitate fraudulent activity. Analysis indicates that eth30.vip was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar often associated with high-risk domains. The domain resolves to the IP address 188.114.97.3, hosted on Cloudflare’s infrastructure (AS13335), which is frequently leveraged by threat actors to obfuscate their true origin. At the time of assessment, 18 out of 95 security vendors on VirusTotal had flagged the domain as malicious, and it appears on two security blocklists. Notably, the domain lacks an SSL certificate, a red flag for any site handling sensitive user data, and has been blocked by multiple anti-fraud systems, including PhishDestroy and ScamSniffer. The combination of these indicators—brand impersonation, recent registration, and lack of security measures—confirms the domain’s malicious intent. Users who visited eth30.vip or interacted with its content should take immediate action to mitigate potential risks. First, disconnect any wallets or accounts linked to the site and revoke any suspicious permissions granted to decentralized applications (dApps). Next, scan the device used to access the domain for malware or unauthorized software. If any transactions were initiated, monitor wallet activity closely for unauthorized transfers and report them to the relevant blockchain explorer or support channels. Finally, reset passwords and enable multi-factor authentication on all cryptocurrency-related accounts to prevent further compromise. Given the domain’s current offline status, users should remain vigilant for similar threats, as threat actors often rebrand or relaunch campaigns under new domains.