trustwallet[.]com-two-factor-authentication06[.]kn[.]llvszw[.]net

This domain is flagged as a high-risk brand impersonation targeting TrustWallet. Analysis of the domain trustwallet.com-two-factor-authentication06.kn.llvszw.net reveals it was registered on May 23, 2026, through IONOS SE, and resolves to IP address 194.164.164.251 located in Germany (AS8560 IONOS SE). The domain uses nameservers ns1.testpphpcss.shop and ns2.testpphpcss.shop, and its SSL certificate is issued by Let's Encrypt. VirusTotal detection shows 12 of 91 security vendors flagging this domain as malicious, and it appears on one security blocklist. The page title is 'Trust Wallet', and the site is currently active, returning HTTP status 200. Technologies detected include Tailwind CSS and Apache HTTP Server. The Gridinsoft trust score is 0 out of 100, indicating a high likelihood of malicious intent. Defenders should block access to this domain and its associated IP address, monitor for related subdomains or variations, and alert users of the TrustWallet brand about this impersonation attempt. The exact content of the page has not been visually analyzed, but the combination of a recently registered domain, low trust score, and brand impersonation classification strongly indicates a phishing campaign aimed at stealing credentials or sensitive information. Further investigation into the hosting provider and nameserver infrastructure may reveal additional malicious domains.