# PhishDestroy domain threat record: your-trustwallet.is-not-certified.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/your-trustwallet.is-not-certified.com/ Machine-readable companion: https://phishdestroy.io/domain/your-trustwallet.is-not-certified.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: unknown - First observed by PhishDestroy: 2026-10-19 13:39:26 UTC - Last availability or vendor check: 2026-10-22 10:00:21 UTC - Stored record updated: 2026-10-22 15:46:57 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Trust Wallet ## Stored infrastructure - Observed IP address: 92.246.89.5 - Registrar in stored WHOIS data: MarkMonitor Inc. - Registration date (registry RDAP, is-not-certified.com): 2007-01-04 14:11:59 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0dbd6-b777-728f-9b83-67ccf41e366b/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/your-trustwallet.is-not-certified.com - Certificate Transparency search: https://crt.sh/?q=%25.your-trustwallet.is-not-certified.com - Web Archive lookup: https://web.archive.org/web/*/https://your-trustwallet.is-not-certified.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview The domain mimics the look and feel of the official Trust Wallet application to lure cryptocurrency owners. PhishDestroy added the site to its blocklist on 2026-10-19 after first seeing it. The current operational status of the site is unknown as of that date. Its purpose appears to be credential or fund theft from Trust Wallet users. How the scam works Visitors are typically shown a replica login or wallet‑connection page that asks for the 12‑word recovery phrase or to approve a transaction. Supplying the seed phrase or granting approval gives the attacker full control of the victim’s wallet, allowing immediate draining of assets. Because the page pretends to be Trust Wallet, users are more likely to trust the request and hand over sensitive information. Evidence VirusTotal scanned the domain with 92 antivirus engines and reported zero detections, meaning mainstream scanners have not yet flagged it. PhishDestroy is the only blocklist currently listing the domain. No detections were reported by Google Safe Browsing, urlscan.io, or Spamhaus at the time of analysis. Infrastructure The domain resolves to IP address 92.246.89.5, which belongs to a generic hosting provider. No registrar or TLS certificate details are available in the supplied information, limiting further attribution of the hosting infrastructure. What to do Anyone who entered a recovery phrase, private key, or approved a transaction on this site should assume the wallet is compromised, immediately move any remaining funds to a new wallet and revoke all approvals from the original Trust Wallet app. Change passwords on any associated accounts and enable hardware‑based 2FA where possible. Security teams should block the domain at network and DNS layers, add it to internal blocklists, and monitor for related traffic. Continue to watch threat feeds for any future detections or takedown updates. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0dbd6-b777-728f-9b83-67ccf41e366b/ VirusTotal report: https://www.virustotal.com/gui/domain/your-trustwallet.is-not-certified.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=your-trustwallet.is-not-certified.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 13:40:35 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a0dbd6-b777-728f-9b83-67ccf41e366b.png Captured: 2026-10-19 13:39:26 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a0dbd6-b777-728f-9b83-67ccf41e366b.png Captured: 2026-10-20 03:30:15 UTC Source report: https://urlscan.io/result/01a0dbd6-b777-728f-9b83-67ccf41e366b/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1ede9beb-012c-4db1-aff0-e953817f459e.png Captured: 2026-10-19 13:40:20 UTC Source report: https://radar.cloudflare.com/scan/1ede9beb-012c-4db1-aff0-e953817f459e SHA-256: 68da103f93622d46f73c6c02e8a6150194cd32bca1c9987cb2b8749970ebb367 - URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a15463-ae1b-7796-b227-b462201a6b23.png Captured: 2026-10-19 13:39:46 UTC Source report: https://urlscan.io/result/01a15463-ae1b-7796-b227-b462201a6b23/ SHA-256: 0b2118b6c4a24a272df40c2304eb453da92653753d04d75c2f46e0e8713f3260 - URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a15467-9111-70c9-9d10-e0311ddb93c0.png Captured: 2026-10-19 13:44:05 UTC Source report: https://urlscan.io/result/01a15467-9111-70c9-9d10-e0311ddb93c0/ SHA-256: 0b2118b6c4a24a272df40c2304eb453da92653753d04d75c2f46e0e8713f3260 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T16:43:45Z", "uuid": "01a0dbd6-b777-728f-9b83-67ccf41e366b", "scanned_at": "2026-09-26T03:51:22Z", "final_url": "https://your-trustwallet.is-not-certified.com/", "status": 200, "ip": "92.246.89.35", "ips": [ "92.246.89.35" ], "asns": [ "210819" ], "countries": [ "DE" ], "doc_hash": "3116c6178783749c82f56c7feeb74c17f21c560ceb2329bccece5e952923b6b4", "globals": [ "requestResize", "toggleCaptcha" ], "tls": { "san": [ "your-trustwallet.is-not-certified.com" ], "cipher": "AES_128_GCM", "issuer": "YR1", "subject": "your-trustwallet.is-not-certified.com", "protocol": "TLS 1.3", "valid_to": "2026-12-25T02:36:44Z", "valid_from": "2026-09-26T02:36:45Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 0, "tls_valid_days": 89, "requests": 3, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx", "content-type": "text/html", "x-powered-by": "PleskLin", "strict-transport-security": "max-age=15768000; includeSubDomains" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T17:55:45Z", "uuid": "1ede9beb-012c-4db1-aff0-e953817f459e", "scanned_at": "2026-10-19T13:40:20Z", "final_url": "https://your-trustwallet.is-not-certified.com/", "status": 200, "history": [ { "url": "https://your-trustwallet.is-not-certified.com/", "status": 200 } ], "dom_hash": "927c70c00fe9bc72fe4f34724412c705677d698b213cee9bd690e3095343cb67", "doc_hash": "742c08c8f32a9c6f9efb99832cc573cc2b06526383114b61ce7a1205423d23b0", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "your-trustwallet.is-not-certified.com", "type": "A", "value": "92.246.89.5" } ], "dnssec_valid": false, "ip": "92.246.89.5", "whois": { "registrar": "MarkMonitor Inc.", "created": "2007-01-04T14:11:59Z", "updated": "2025-12-03T10:00:14Z", "expires": "2027-01-04T14:11:59Z", "nameservers": [ "ns1.p201.dns.oraclecloud.net", "ns2.p201.dns.oraclecloud.net", "ns3.p201.dns.oraclecloud.net", "ns4.p201.dns.oraclecloud.net" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-20T18:06:30Z", "analysis_at": "2026-10-19T14:05:38Z", "stats": { "timeout": 0, "harmless": 52, "malicious": 3, "suspicious": 2, "undetected": 35 }, "detections": { "ESET": "suspicious", "Emsisoft": "phishing", "Netcraft": "malicious", "LevelBlue": "phishing", "alphaMountain.ai": "suspicious" }, "reputation": 0, "categories": { "alphaMountain.ai": "Suspicious, Dynamic DNS (alphaMountain.ai)" }, "registrar": "MarkMonitor Inc.", "created": "2007-01-04T14:11:59Z", "expires": "2027-01-04T14:11:59Z", "updated": "2025-12-03T10:00:14Z", "first_seen": "2026-09-26T03:49:50Z", "dns": [ { "ttl": 60, "type": "A", "value": "92.246.89.5" } ], "dns_at": "2026-10-19T14:11:00Z", "jarm": "29d3fd00029d29d00042d43d0000002059a3b916699461c5923779b77cf06b", "cert": { "san": [ "your-trustwallet.is-not-certified.com" ], "issuer": "Let's Encrypt / YR1", "serial": "61c963efe815869a6abd1fcb757a1aeef46", "sha256": "8f53c47aa7fc9fd985bb9a9959e9abf02d09773ed56e7b58d4ffad3f0d40338f", "subject": "your-trustwallet.is-not-certified.com", "valid_to": "2027-01-11T08:21:53Z", "valid_from": "2026-10-13T08:21:54Z" }, "whois": { "registrar": "MarkMonitor Inc.", "registrar_iana_id": "292", "registrar_url": "http://www.markmonitor.com", "created": "2007-01-04T14:11:59Z", "updated": "2025-12-03T10:00:14Z", "expires": "2027-01-04T00:00:00Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "ns1.p201.dns.oraclecloud.net", "ns2.p201.dns.oraclecloud.net", "ns3.p201.dns.oraclecloud.net", "ns4.p201.dns.oraclecloud.net" ], "dnssec": "unsigned" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-21T20:07:05Z", "caa_records": { "domain": "your-trustwallet.is-not-certified.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-19T13:44:10Z", "first": "2026-10-19T13:44:10Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 28678 }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false } } } ```