trastwallet[.]loan

This domain is currently under investigation for brand impersonation targeting Trust Wallet, a cryptocurrency wallet service. Analysis indicates the site presents itself as a non-custodial wallet for browsers, PCs, and phones, using localized Russian-language content to deceive users into disclosing wallet credentials or installing malicious software. The specific threat type is a crypto wallet impersonation scam, likely designed to facilitate unauthorized access to victims' digital assets or deploy crypto-draining malware. Infrastructure analysis reveals the domain was registered on June 24, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3. As of the latest scan, the domain has zero detections out of 95 security engines on VirusTotal, indicating it has not yet been widely flagged by automated detection systems. The SSL certificate is issued by Google Trust Services, providing a veneer of legitimacy. No blocklist entries or negative trust scores have been recorded at this time, though the domain remains active and unmitigated. Mitigation steps for this threat type include immediate blacklisting of the domain and IP address within network security controls. Organizations should update endpoint protection rules to detect and block access to trastwallet.loan and monitor for related phishing campaigns targeting cryptocurrency users. Users who may have interacted with the site should revoke any connected wallet permissions, transfer assets to a new wallet, and scan their devices for malware. Security teams are advised to conduct retroactive log analysis for connections to 188.114.96.3 and the domain, particularly from high-risk regions or devices handling cryptocurrency transactions.