trustwallet-audit[.]app

This domain, trustwallet-audit.app, is actively flagged as a high-risk crypto scam impersonating TrustWallet, a known cryptocurrency wallet service. Registered through Cloudflare, Inc., the domain resolves to IP address 172.67.143.162, hosted on AS13335 (Cloudflare, Inc.) in the United States. Nameservers jihoon.ns.cloudflare.com and katja.ns.cloudflare.com further confirm Cloudflare-managed infrastructure. The domain currently returns an HTTP 200 status and displays the page title 'Nur einen Moment…', suggesting a temporary or intermediate page, though the exact content remains unanalyzed. Analysis indicates the domain is designed to deceive users by leveraging TrustWallet’s branding, as explicitly noted in threat intelligence. It appears on at least one security blocklist and is flagged by three of 95 security vendors in a recent scan. The domain’s Gridinsoft trust score of 0/100 reinforces its malicious classification. Detected technologies include Cloudflare Browser Insights, Cloudflare, and HTTP/3, consistent with modern phishing infrastructure leveraging CDN services to evade detection and takedown efforts. Defenders should treat this domain as an active threat. The use of Cloudflare hosting and nameservers may complicate attribution and mitigation, but the domain’s presence on blocklists and vendor detections provides actionable indicators for network-level blocking. Given the crypto scam classification, users encountering this domain should be alerted to potential credential theft or fraudulent transaction risks. Further investigation into associated wallet addresses or backend infrastructure may reveal additional attack vectors or linked campaigns. No evidence currently suggests this domain is part of a broader kit or affiliate network, though this remains a possibility.