cpanel[.]trustwalletmail[.]net

This domain, cpanel.trustwalletmail.net, was registered through Hostinger Operations, UAB, indicating a hosting provider that often supplies affordable shared services. The domain resolves to name servers ns1.craftinnovations.ng and ns2.craftinnovations.ng, suggesting that the underlying infrastructure is hosted in the .ng naming space. An HTTP request to the root returns a 200 OK status, confirming that a web service is actively responding. VirusTotal analysis shows that 11 of 91 security vendors have flagged the domain, reflecting a moderate level of detection across multiple scanners.

The domain is presently listed on a single security blocklist and has been blocked by the PhishDestroy filtering service, providing at least one upstream mitigation. The threat type is identified as a crypto drainer, and the risk level is high, with the campaign status marked as active as of the report date, 25 July 2026. Observed evidence stops at the registration, name server configuration, HTTP response, and vendor detection count; no additional details such as SSL certificate attributes, page title, or content are available in the current intelligence set. Consequently, defenders should assume the domain is being used to lure victims into transferring cryptocurrency to attacker‑controlled addresses and should enforce strict egress controls on wallet interactions, monitor outbound blockchain transaction attempts, and add the domain to local blocklists.

Continuous monitoring of VirusTotal updates and blocklist changes is recommended, as additional detections may emerge. Organizations employing email filters should ensure that the domain is explicitly denied, and any inbound traffic to the host should be logged for forensic analysis. Because the infrastructure relies on generic name servers, further probing of the hosting IP range may reveal related malicious assets that can be proactively neutralized.