trustwallet-lhz[.]com

The domain trustwallet-lhz.com is flagged as a high-risk brand impersonation threat targeting Trust Wallet, a cryptocurrency wallet service. Analysis confirms the domain was actively spoofing Trust Wallet’s official branding to deceive users into disclosing sensitive credentials or installing malicious software. The domain is currently offline, though prior activity indicates a deliberate attempt to exploit user trust in the targeted brand. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Gname.com Pte. Ltd. and resolved to the IP address 45.207.200.102, hosted under AS8796 (FASTNET DATA INC). Security assessments show the domain was flagged by 17 of 95 vendors on VirusTotal, with detections spanning phishing, malware distribution, and fraudulent activity. The domain appears on three security blocklists, and its SSL certificate, issued by Let's Encrypt (R13), was likely used to lend superficial legitimacy to the operation. The page title, matching the domain name, further suggests an attempt to mimic official Trust Wallet communications. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Security teams are advised to block the domain and associated IP (45.207.200.102) at the network perimeter. Users should verify all communications against official Trust Wallet channels and report any suspicious activity to their security providers. Organizations should monitor for related domains registered through the same registrar or resolving to the same IP range, as threat actors frequently reuse infrastructure for subsequent campaigns.