trustwallet-connection[.]com

Analysis of the domain trustwallet-connection.com indicates a confirmed brand impersonation targeting TrustWallet, a cryptocurrency wallet service. The domain was registered on August 10, 2025, through Tucows Domains Inc. and is currently offline, returning an HTTP 451 status code. Infrastructure analysis reveals hosting on Amazon.com, Inc. (AS16509) in the United States, resolving to the IP address 64.29.17.65. The domain employs Vercel nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com) and utilizes a Let's Encrypt SSL certificate (R13), with HSTS enabled. The page title, 'Trust Wallet - Connection,' directly aligns with the impersonated brand, reinforcing the classification as a crypto scam.

Security vendors have flagged this domain, with 4 out of 95 engines on VirusTotal detecting malicious activity. It appears on six security blocklists, including PhishDestroy, MetaMask, Polkadot, SEAL, and Enkrypt, which have proactively blocked access. The domain's creation date, combined with its rapid detection and subsequent takedown, suggests a short-lived but high-risk operation. While the exact content of the site remains unanalyzed, the combination of infrastructure, hosting provider, and blocklist presence provides concrete evidence of fraudulent intent.

Defenders should treat this domain as a confirmed threat, particularly in environments where TrustWallet or cryptocurrency-related services are used. Monitoring for related domains with similar naming patterns (e.g., 'trustwallet-[modifier].com') is recommended, as threat actors often reuse infrastructure or naming conventions. Given the domain's current offline status, further forensic analysis may be limited, but historical DNS and WHOIS records should be preserved for potential investigations. Organizations should ensure endpoint protection and browser-based security tools are updated to block this domain and any associated indicators of compromise.