user5044[.]trustcard[.]ac

Analysis of user5044.trustcard.ac indicates a confirmed wallet‑seed phishing operation targeting Mastercard customers. The domain was registered on 21 February 2026 through Global Domain Group LLC and points to the Cloudflare address 172.67.129.163, belonging to AS13335 in the United States. Resolver records show the authoritative name servers brady.ns.cloudflare.com and uma.ns.cloudflare.com, confirming that the site was hosted behind Cloudflare’s public CDN. No TLS certificate is observed, meaning the site served traffic over plain HTTP, a configuration frequently used to simplify credential capture.

The page title retrieved from the live snapshot reads “Trust | Your Private Crypto Card”, and the brand target field lists Mastercard, matching the wallet/seed phishing profile. VirusTotal analysis reports that 14 of 95 scanning engines flagged the domain as malicious, reinforcing the suspicion of a credential‑harvesting payload. The domain appears on two independent phishing blocklists—PhishDestroy and ScamSniffer—both of which have already taken it offline. Gridinsoft assigns a trust score of 0 / 100, indicating a lack of benign reputation.

Although the site is currently inaccessible, defenders should continue to block the domain and the associated IP address at perimeter and DNS filtering layers, and should monitor for new registrations that reuse the “trustcard” sub‑domain pattern or that resolve to the same Cloudflare‑owned IP range. Enrichment of threat‑intel feeds with the registrar, creation date, and the observed page title will aid early detection of copycat campaigns. Observers are advised to treat any unsolicited communications referencing “private crypto card” or Mastercard‑related seed requests as malicious until proven otherwise.