trust-card[.]at

Analysis indicates that the domain trust-card.at was registered on 21 February 2026 and is currently resolved to the IPv4 address 158.94.209.135, which belongs to an NL‑based network (AS202412 Omegatech LTD). The authoritative name servers are ns1.openprovider.nl, ns2.openprovider.be and ns3.openprovider.eu, and the registrar listed is Hosting Concepts B.V. d/b/a Registrar.eu. The site presents the page title “Trust Card | Your Private Crypto Card”, explicitly referencing the Trust Wallet brand, and is classified as a crypto‑scam. The TLS certificate presented by the server is issued to “Hestia Control Panel / panel.simpleswap.mobi”, a mismatch that is typical of malicious infrastructure and further weakens trust signals.

The domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 out of 100, confirming the malicious reputation. VirusTotal analysis shows that 13 of 93 scanning engines have flagged the domain, providing independent confirmation of its malicious nature. The combination of a recent creation date, low‑reputation SSL, a dedicated hosting provider, and the presence on multiple blocklists suggests a purpose‑built operation targeting Trust Wallet users with a crypto‑draining scheme.

Uncertainty remains regarding the exact phishing workflow, the presence of credential‑stealing forms, or any secondary payloads, as no page content beyond the title has been examined. Defenders should add trust-card.at and its resolving IP 158.94.209.135 to URL and IP blocklists, enforce TLS inspection to detect the mismatched certificate, and monitor traffic to the OpenProvider name server range for similar patterns. Incident response teams should also flag any outbound connections to the domain as suspicious and consider user education campaigns that reference the “Trust Card” naming pattern to reduce successful credential harvest attempts.