trustwallet[.]case[.]user[.]id512c6s4[.]vorba[.]org

The domain trustwallet.case.user.id512c6s4.vorba.org was registered on February 21, 2026 and remains active as of the report date, July 25, 2026. It resolves to the IP address 200.69.17.201, which is hosted in the United States and assigned to ASN40092 (HostPapa). The authoritative name servers are ns1.hostpapa.com and ns2.hostpapa.com, and the registrar is listed as eNom, LLC. The web server runs Nginx and presents a TLS certificate issued by Let’s Encrypt (R13). An HTTP request returns status 200 and the page title is "Vite + React," indicating a generic development stack rather than any brand‑specific content.

The site is classified as a crypto‑scam and is specifically targeting Trust Wallet users through brand impersonation. Reputation data shows a Gridinsoft trust score of 0 out of 100, and three security blocklists have listed the domain. VirusTotal analysis flags the domain on three of 93 scanners, and it is also blocked by PhishDestroy, MetaMask, and SEAL. The available evidence confirms a hostile infrastructure designed to lure cryptocurrency wallet users, but the exact phishing flow, credential‑capture mechanisms, or additional payloads have not been observed.

Defenders should block the domain at network perimeter and DNS layers, monitor outbound connections to 200.69.17.201, and add the domain to internal threat intel feeds. Continuous re‑scanning with multi‑engine services is advised to capture any evolving malicious components. Incident response teams should also review any user reports of Trust Wallet credential requests that could be linked to this infrastructure.