trustalabs[.]run

Analysis of trustalabs.run shows a short-lived infrastructure that was created on February 21, 2026 and is currently taken offline. The domain resolves to the Cloudflare address 172.67.150.152, located in the United States and advertised under ASN 13335. A TLS certificate identified as "WE1" is present, indicating that HTTPS was enabled despite the site’s brief lifespan. The page title returned by the server reads "Trusta $TA Coming," which aligns with the reported scam type of a fake airdrop.

The threat profile lists the target brand as "across," suggesting an attempt to impersonate multiple brands rather than a single named entity. Reputation services rate the host extremely poorly: Gridinsoft assigns a trust score of 0 out of 100, and Scamadviser reports a score of 1 out of 100. VirusTotal records three detections out of ninety‑three scanned engines, confirming that at least a subset of security products flagged the domain as malicious. Independent blocklists, including PhishDestroy and ScamSniffer, have already added the domain to their watchlists, and two additional security blocklists reference it.

The combined evidence points to a coordinated fake‑airdrop campaign that leverages the domain to lure victims with promises of token distribution, as implied by the "$TA" token reference in the title. Defenders should immediately block trustalabs.run at network perimeter devices, update intrusion‑detection signatures with the observed IP and SSL fingerprint, and monitor for newly registered domains that share the same creation window, Cloudflare hosting, or similar title patterns. Continuous ingestion of the listed blocklists will help surface any re‑use of the underlying infrastructure.