trustwellfinancialbank[.]org

This domain, trustwellfinancialbank.org, is flagged for brand impersonation targeting Trust Wallet, a cryptocurrency wallet service. Analysis indicates the infrastructure was designed to deceive users into believing they were interacting with a legitimate financial institution, specifically labeled as 'TrustWell financial Bank' in the page title. The threat type aligns with credential harvesting and potential cryptocurrency theft, though no specific drainer kit signatures were identified in the available data. The domain mimics Trust Wallet’s branding to exploit user trust, likely through fake login portals or transaction prompts. Infrastructure analysis reveals the domain was registered on June 21, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 192.3.190.186 and has been flagged by 1 of 95 security vendors on VirusTotal. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The creation date suggests recent deployment, while the low detection rate (1/95) indicates limited prior exposure or evasion techniques. The domain is currently offline, reducing immediate risk to users. However, the infrastructure may be reactivated under a different domain or IP address. The registrar and hosting provider have not publicly disclosed remediation actions, leaving residual risk for users who may have interacted with the domain prior to takedown. Users are advised to verify wallet addresses, avoid clicking on unsolicited financial links, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts.