Security researcher @harugasumi posted on X on 11 November 2026 about phishing emails impersonating Trust Wallet, the cryptocurrency wallet, with subjects such as '[Important notice] Trust Wallet usage confirmation re…
Source: x.com · published
Security researcher @harugasumi posted on X on 11 November 2026 about phishing emails impersonating Trust Wallet, the cryptocurrency wallet, with subjects such as '[Important notice] Trust Wallet usage confirmation request'. According to the post, the emails lead to the phishing site hxxps://trustwallet.com-users[.]vip/. Despite starting with 'trustwallet.com', the real domain is com-users.vip, which is not operated by Trust Wallet. The domain also appears on the Phishing Army extended blocklist, a public phishing domain blocklist. Never enter a wallet recovery phrase on a website, and use only the official Trust Wallet app.
Wallet and exchange phishing pages often follow an email, comment or advert that says you must confirm your account, update an app or claim a token credit. The page may ask for a recovery phrase, a private key or a password. Official wallet apps and hardware devices never need those words to be typed into a website. Close the page, open only the official app or a bookmark you already use, and if you entered a phrase treat the wallet as compromised and move funds to a new wallet whose phrase you created offline, if you still can.
The address trustwallet.com-users.vip is built to look as if it is part of trustwallet.com, but the real registered domain is com-users.vip and is not operated by Trust Wallet. Trust Wallet was impersonated and is not involved. The same domain also appears on the Phishing Army extended blocklist. Similar wallet lures flagged the same day include a fake Magic Eden page and a fake Ledger Live download page.
Public post on X, 11 November 2026: https://x.com/harugasumi/status/2120508187933831651
The indicators come from this source and have not been independently checked by scammers.com.
Security researcher @harugasumi posted on X on 11 November 2026 about phishing emails impersonating Nishi-Nippon City Bank (西日本シティ銀行) and Kyushu Card (九州カード), using subjects such as a notice of the November payment am…
Anti-phishing project PhishDestroy posted on Mastodon on 12 November 2026 that zerion-inc[.]webflow[.]io is a suspected phishing site. Its domain record shows a page copying Zerion's wallet homepage ("Crypto Wallet fo…
ScanMalware posted on X on 12 November 2026 that multi-xchange[.]firebaseapp[.]com is a confirmed scam. Its scan report describes a wallet-drainer phishing page posing as WalletLink, a wallet-connection brand, on a fr…
Stablecoin DEX aggregator Tower Exchange (@TowerExchange) posted a security alert on X on 12 November 2026 saying a coordinated scam is running under its name. According to the company, an account using the name "Jeff…
Web3 anti-scam service Scam Sniffer (@realScamSniffer) reported on X on 12 November 2026 that a user lost about $11.7K in USDC on Ethereum to an address-poisoning attack. The funds went to 0x7f8226aa9f47ec9e0db0b55253…
The urlDNA scanning service posted on Mastodon on 11 November 2026 that hxxps://wallet-magiceden-io.webflow.io is a possible phishing page, linking its scan. The domain also appears on the Phishing Army extended block…