web3-trust-wallet[.]com

This domain is flagged as a high-risk brand impersonation threat designed to deceive users of the Trust Wallet cryptocurrency platform. Analysis indicates the infrastructure is actively facilitating crypto wallet fraud, likely through credential harvesting or transaction manipulation to drain digital assets. The domain exhibits characteristics consistent with crypto drainer operations, including the use of legitimate-seeming interfaces to trick victims into authorizing malicious transactions or disclosing recovery phrases. Infrastructure analysis reveals the domain was registered on February 21, 2025, through Cloudflare, Inc., and currently resolves to the IP address 188.114.97.3. Detection metrics show 16 out of 95 security vendors on VirusTotal have flagged the domain as malicious, while three distinct security blocklists have included it in their denylists. The domain holds a trust score of 0/100 from Gridinsoft, further corroborating its malicious classification. Technologies detected on the site include Envoy, HSTS, Cloudflare Browser Insights, and HTTP/3, with an SSL certificate issued by Google Trust Services. The page title, 'Just a moment...,' suggests the use of evasion techniques to delay or obscure malicious content delivery. Mitigation against this threat requires immediate action from both end users and security teams. Trust Wallet users should verify domain authenticity before entering credentials or connecting wallets, ensuring they only interact with the official platform. Security teams are advised to block the domain and its resolving IP (188.114.97.3) at the network perimeter, while also monitoring for related indicators of compromise, such as unusual transaction patterns or unauthorized wallet access. Organizations should educate users on recognizing brand impersonation tactics, particularly those involving crypto wallets, and enforce multi-factor authentication for all sensitive operations.