cn-trustwallet[.]co

This domain, cn-trustwallet.co, is identified as a high-risk brand impersonation threat targeting Trust Wallet, a cryptocurrency wallet service. The site presented itself as the official Chinese-language portal for Trust Wallet, using the page title 'Trust Wallet 官网 - 安全Web3钱包下载 2026' to deceive users into believing it was a legitimate download source. No direct evidence of a crypto drainer kit was observed, but the domain’s structure and content align with known impersonation tactics designed to harvest credentials or distribute malicious software.

Analysis indicates the domain was registered on April 29, 2026, through an undisclosed registrar, with an SSL certificate issued by Let's Encrypt (R13). It resolved to the IP address 193.143.1.166, hosted by Proton66 OOO in Russia. The domain appears on three security blocklists and is flagged by 13 out of 95 security vendors on VirusTotal. No Google Safe Browsing (GSB) detection was explicitly noted, but the combination of blocklist inclusions and vendor detections underscores its malicious classification.

As of the latest assessment, cn-trustwallet.co has been taken offline, likely due to enforcement actions by security providers such as PhishDestroy, MetaMask, and SEAL. Despite its current inactive status, the domain’s infrastructure and registration details remain a potential vector for future abuse. Organizations and users are advised to maintain blocklist updates and monitor for re-emergence under similar naming conventions or hosting providers. Additional scrutiny of domains impersonating cryptocurrency services is recommended, particularly those using Let’s Encrypt certificates or Russian-hosted infrastructure.