trust-walletpay[.]com

trust-walletpay.com was registered through CNOBIN INFORMATION TECHNOLOGY LIMITED and first observed on August 5 2026. The domain resolves to the IP address 104.21.61.112, which is associated with a Cloudflare‑owned network. VirusTotal scans show that 2 of 91 security vendors have flagged the domain as malicious, indicating that at least a minority of AV engines recognize it as part of a crypto‑drainer campaign. The domain is listed on three independent security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the consensus that it is being used to compromise cryptocurrency wallets.

The threat profile is classified as a crypto drainer, meaning the site is likely employed to lure victims into authorising transactions that transfer digital assets to attacker‑controlled addresses. No public page title or SSL certificate details have been disclosed, and no additional infrastructure such as command‑and‑control servers or drop sites have been identified in the current dataset. Consequently, the full extent of the campaign’s payload delivery mechanisms remains uncertain. Defenders should add trust-walletpay.com to DNS‑based deny lists, block outbound connections to its IP address, and monitor for any wallet‑related transaction attempts that reference this domain.

Users of cryptocurrency wallet extensions should be reminded that MetaMask already blocks the domain, but they should remain vigilant for look‑alike URLs. Continuous re‑scanning on VirusTotal and periodic checks against blocklist updates are recommended to capture any escalation in detection rates. The domain’s active status and elevated risk rating warrant immediate inclusion in intrusion‑prevention and endpoint‑detection policies.