twt11[.]top

Analysis of twt11.top shows a brand‑impersonation campaign targeting Trust Wallet users. The domain was registered on 2025-10-07 through NiceNIC International Group Co., Limited and resolves to the IPv4 address 209.94.90.1, which belongs to AS40680 (Protocol Labs) located in the United States. No TLS certificate is presented; the site was reachable via HTTP only before being taken offline. The page title returned by the server, “REWARD Portal v2 -- Latest Web3 Wallets”, aligns with the previously observed “Wallet/Seed Phishing” kit and reinforces the claim that the operator attempts to harvest cryptocurrency wallet credentials or seed phrases. VirusTotal records indicate that four of ninety‑five scanning engines flagged the domain, and Gridinsoft assigned a trust score of zero out of one hundred, suggesting a high likelihood of malicious intent.

The domain appears on a single public blocklist and is listed in one AlienVault OTX pulse, confirming that at least one external threat‑intel source has catalogued the indicator. PhishDestroy also reports the domain as blocked, providing further confirmation of its malicious use. Defenders should add twt11.top to URL filtering and DNS block policies across enterprise gateways. Because the hosting IP is owned by Protocol Labs, monitoring for additional subdomains or newly‑registered domains pointing to the same address is advisable.

The absence of SSL does not mitigate risk; HTTP traffic can still be used to deliver credential‑stealing forms. Updating endpoint detection signatures to include the observed page title and the “REWARD Portal v2” string can improve detection of similar clones. Organizations that provide Trust Wallet support should issue user advisories reminding users that official Trust Wallet communications never request seed phrases via external portals and that any request for “reward” information should be treated as fraudulent. Continuous review of the registrar NiceNIC International Group Co.