rahul[.]transactionshield[.]info

rahul.transactionshield.info is currently active and hosts a page titled “Transfer Trust Wallet”. The site resolves to 104.21.14.198, an address owned by Cloudflare (AS13335) located in the United States. DNS is served by nora.ns.cloudflare.com and uriah.ns.cloudflare.com, confirming that the domain is using Cloudflare’s DNS and CDN services. The HTTPS certificate is issued by Google Trust Services under the WE1 intermediate, indicating a valid TLS certificate for the domain. HTTP requests receive a 302 redirect, suggesting the site forwards visitors to another location, though the target URL is not disclosed. VirusTotal reports four detections out of 91 scanned scanners, and Gridinsoft assigns a trust score of 0/100, reinforcing the malicious assessment. The domain appears on one public blocklist and is listed by PhishDestroy as a confirmed brand‑impersonation case targeting TrustWallet. Registration was performed through Hostinger operations, UAB, but no further WHOIS details are provided. The evidence points to a high‑risk brand‑impersonation campaign that attempts to lure TrustWallet users into transferring assets. Uncertainty remains regarding the exact payload or credential‑capture mechanism because the page content has not been analyzed. Defenders should block the domain at network perimeter, update URL filtering rules, and monitor for connections to the Cloudflare IP address. Incident response teams should treat any traffic from internal clients to this domain as suspicious and investigate potential credential exposure.