wave-trustwallet[.]com

PhishDestroy identifies wave-trustwallet.com as an active brand impersonation site targeting Trust Wallet users. This domain is currently under investigation as part of a confirmed phishing campaign designed to deceive visitors into entering sensitive wallet credentials under the guise of a legitimate Trust Wallet service. The site leverages visual and textual elements that closely resemble Trust Wallet’s official branding, creating a high-risk deception vector for cryptocurrency users seeking secure wallet access.

This domain was flagged by 2 of 95 VirusTotal security vendors, indicating it has not yet been widely recognized as malicious despite its deceptive nature. It is registered through Cloudflare, Inc., resolves to IP address 104.21.95.242, and was created on April 27, 2026. The domain uses a valid SSL certificate issued by Let's Encrypt, enhancing its appearance of legitimacy. Currently, it remains unlisted on major threat intelligence blocklists, and VirusTotal shows zero detections, suggesting a newly deployed or stealthily operated campaign. Trust scores are low due to the absence of detection and the recent domain registration.

Given the domain’s active status and direct impersonation of a major cryptocurrency wallet provider, PhishDestroy assesses this site as high-risk. Users who access wave-trustwallet.com risk exposing their seed phrases, private keys, or login credentials to threat actors. Immediate action is recommended: avoid visiting the domain, verify any wallet access links by typing the official URL manually, and report the domain to Trust Wallet’s abuse team and browsers via Google Safe Browsing. Organizations should consider DNS blocking and user awareness training to mitigate exposure to this and similar impersonation campaigns.