# PhishDestroy threat dossier — trustwalletuserid.com ================================================================ Fetched: 2026-05-25 16:53:53 UTC Canonical: https://phishdestroy.io/domain/trustwalletuserid.com/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 92/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Trust Wallet ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/95 security vendors flagged this domain Flagging vendors: Ermes, Fortinet ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 82.29.191.22 (GB, Manchester) ASN: AS47583 Hostinger International Limited Hosting org: HOSTINGER GB Registrar: OwnRegistrar, Inc. Nameservers: horizon.dns-parking.com, orbit.dns-parking.com Registered: 2026-05-05 Page title: TrustwalletID HTTP response: 530 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R13 Expires: 2026-08-03 Status: INVALID chain Fingerprint: c68b58b7a5b0551b2944f90cceaaebbb95a2c8225905e7faf635314474e480c2 Subject Alternative Names (related infrastructure — often same operator): - www.trustwalletuserid.com ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-05 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-07 14:06:23 UTC (by PhishDestroy tracker) Last verified: 2026-05-25 19:32:41 UTC Neutralised: 2026-05-14 20:55:21 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019e021b-d47b-718e-a6d9-32bf2e9c964e/ Wayback Machine: https://web.archive.org/web/*/trustwalletuserid.com crt.sh CT logs: https://crt.sh/?q=%25.trustwalletuserid.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=trustwalletuserid.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/trustwalletuserid.com URLhaus: https://urlhaus.abuse.ch/host/trustwalletuserid.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-07 14:07:34 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] trustwalletuserid.com is a fraudulent website that impersonates Trust Wallet, a popular cryptocurrency wallet service. This site is designed to trick users into entering their Trust Wallet login credentials by mimicking the official Trust Wallet website. Once harvested, these credentials can be used by cybercriminals to gain unauthorized access to victims' cryptocurrency funds and personal data. PhishDestroy identifies this domain as a confirmed credential-harvesting scam. The domain trustwalletuserid.com, registered on May 05, 2026, was found to be hosted on the IP address 82.29.191.22 and uses a Let's Encrypt SSL certificate to appear legitimate. VirusTotal, a leading threat intelligence platform, detected this domain as malicious with only 2 out of 95 security vendors flagging it, indicating a low initial detection rate that could allow the scam to spread undetected. The domain was registered through OwnRegistrar, Inc., a registrar often exploited by bad actors for quick, anonymous registrations. If you visited trustwalletuserid.com, immediately change your Trust Wallet password and enable two-factor authentication (2FA) if you haven’t already. Check your transaction history for unauthorized activity and consider transferring your assets to a new wallet if you suspect your credentials were compromised. Avoid clicking on any links from unsolicited emails or messages, and always verify the website URL before entering sensitive information. Use bookmarks or manually type the official Trust Wallet URL (trustwallet.com) to ensure you’re on the legitimate site. Report this scam to Trust Wallet’s support team and consider running a malware scan on your device to rule out any additional threats. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 881358ef09536458cb689d0022a81c23 TLS cert SHA-256: c68b58b7a5b0551b2944f90cceaaebbb95a2c8225905e7faf635314474e480c2 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/trustwalletuserid.com/ JSON API: https://api.destroy.tools/v1/check?domain=trustwalletuserid.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 152,979 domains (39,186 alive under monitoring, 113,378 confirmed takedowns/dead). Site: https://phishdestroy.io