m[.]trustwalletccu[.]com

The domain m.trustwalletccu.com was identified as a brand impersonation threat targeting Trust Wallet, a cryptocurrency wallet service. Analysis confirms the domain was designed to deceive users by mimicking the legitimate Trust Wallet platform, likely for credential harvesting or cryptocurrency theft. The domain is currently offline, though its infrastructure and historical activity warrant continued monitoring. Technical indicators reveal the domain was flagged by 17 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It was registered through Gname.com Pte. Ltd. on May 02, 2026, an unusually future-dated registration that may suggest evasion tactics. The domain resolves to the IP address 47.80.68.7 and appears on three security blocklists, including MetaMask, PhishDestroy, and SEAL. Additional infrastructure details include the use of an SSL certificate issued by Let's Encrypt, Nginx as the web server, and support for HSTS and HTTP/3 protocols. The page title, rendered in non-Latin characters (网站搭建中), translates to 'Website under construction,' a common tactic to obscure malicious intent. Given the high-risk classification and historical malicious activity, organizations should treat this domain as a confirmed threat. Immediate actions include blocking the domain and its associated IP (47.80.68.7) at the network perimeter, updating endpoint protection rules to flag related indicators, and alerting users to the impersonation risk. Security teams should also monitor for similar domains registered through the same registrar (Gname.com Pte. Ltd.) or resolving to the same IP range, as these may indicate further phishing campaigns. Future investigations should prioritize domains with future-dated registrations or non-standard page content as potential red flags.