trustwalletdownload[.]co[.]com

Analysis of trustwalletdownload.co.com indicates that the domain is being used to impersonate the Trust Wallet brand in a crypto‑related scam. The site is currently offline, but historical data shows it resolved to the IP address 169.60.151.233, which is hosted by SoftLayer Technologies, Inc. in the United States. The domain was registered on August 16, 1997 through Moniker Online Services LLC and is served by the four authoritative name servers ns1.nic.co.com through ns4.nic.co.com. No SSL certificate was observed for the host, meaning traffic would have been delivered over plain HTTP. Infrastructure scoring from Gridinsoft assigns the domain a trust score of 0 out of 100, reflecting a high likelihood of malicious intent.

The domain appears on a single security blocklist and has been flagged by the PhishDestroy blocklist, confirming that defensive feeds have recognized it as a threat. VirusTotal reports that the domain was scanned by 95 vendors, none of which raised a detection; however, the absence of detections does not constitute evidence of safety, especially given the other corroborating indicators. The brand target is explicitly listed as Trust Wallet, and the scam type is identified as a crypto scam, suggesting that any future payloads would aim to harvest cryptocurrency credentials or funds. Because the site is offline, direct observation of its content is not possible, leaving the exact phishing page layout and lure techniques unknown.

Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑activation of the host, and add the IP address 169.60.151.233 to threat‑intel feeds. Additional scrutiny of any traffic originating from SoftLayer’s network for similar brand‑impersonation patterns is recommended. Organizations using Trust Wallet should educate users about the risk of unsolicited download links and enforce strict URL verification policies.