trustwallet-restore[.]com

This domain, trustwallet-restore.com, is actively impersonating Trust Wallet as part of a cryptocurrency recovery scam. Registered on February 21, 2026, through OwnRegistrar, Inc., the domain currently resolves to 172.67.185.184, a Cloudflare-hosted IP address within AS13335. Infrastructure analysis reveals the use of Cloudflare nameservers (celine.ns.cloudflare.com and zeus.ns.cloudflare.com) and technologies such as Cloudflare Browser Insights and HTTP/3, which are consistent with modern phishing operations attempting to evade detection. The domain is flagged by three security blocklists and has been identified by three out of ninety-five security vendors on VirusTotal, including confirmed blocks by PhishDestroy, MetaMask, and SEAL. Despite presenting a 500 Internal Server Error and a 301 HTTP status, the domain remains operational, suggesting either intermittent availability or a deliberate attempt to obscure its malicious activity. The SSL certificate, issued by Google Trust Services, does not mitigate the threat, as phishing sites commonly leverage valid certificates to appear legitimate. Defenders should treat this domain as high-risk due to its direct association with cryptocurrency fraud. The use of Cloudflare infrastructure complicates traditional IP-based blocking, necessitating domain-level enforcement. Given the domain's persistence since February 2026 and its inclusion on multiple blocklists, it is likely part of a broader campaign targeting Trust Wallet users. Security teams should prioritize monitoring for related domains or IPs, particularly those sharing the same registrar or nameserver patterns. Immediate action includes adding the domain to internal blocklists and alerting users to avoid interaction with any communications or sites claiming to offer Trust Wallet recovery services.