trustwallet[.]lt

The domain trustwallet.lt was registered on 21 February 2026 and is currently taken offline. Passive DNS shows the authoritative name servers ns1.dns‑suspended.com and ns2.dns‑suspended.com, both typical of abandoned or suspended hosting. The domain resolves to the IPv6 address 2600:1901:0:84ef::, which belongs to AS396982 owned by Google LLC and is geolocated in the United States. An SSL certificate with an E6 rating is present, indicating a low‑grade or self‑signed certificate. The page title returned by the web server is “Trust Wallet: Your Crypto News Hub | Trustwallet”, which references the legitimate Trust Wallet brand but the intelligence flags the site as impersonating the “blur” brand, suggesting a targeted brand‑impersonation campaign aimed at cryptocurrency users.

Reputation services have flagged the domain. Three of ninety‑three VirusTotal scanners raised alerts, and the domain appears on four public blocklists. It has been added to the blocklists of PhishDestroy, Polkadot, Enkrypt, and Codeesura, confirming that multiple independent providers consider it malicious. A Gridinsoft trust score of 0 out of 100 further corroborates the lack of credibility. The scam type is identified as a crypto scam, consistent with the use of the Trust Wallet reference.

Because the site is offline, active probing is limited, but the available indicators are sufficient for defensive actions. Organizations should add trustwallet.lt to DNS‑based deny lists, update web proxy and endpoint filters, and monitor for any future re‑registration of the domain or similar sub‑domains. Continuous observation of the associated IP range (AS396982) is advised, as the same hosting infrastructure may be reused for other malicious campaigns. Incident response teams should also verify that any internal communications referencing “blur” or Trust Wallet are not being redirected to this domain, and should educate users about the risk of unsolicited links that claim to deliver crypto news.