trustwallet-app[.]io

This domain, trustwallet-app.io, is flagged as a high-risk brand impersonation threat targeting Trust Wallet, a widely used cryptocurrency wallet service. Analysis indicates the domain was designed to mimic the legitimate Trust Wallet platform, likely to harvest user credentials, private keys, or seed phrases through a crypto drainer kit. The page title, 'Trust Wallet | Secure Crypto Wallet Access,' reinforces the deception by closely resembling the official branding, increasing the likelihood of successful phishing attempts against unsuspecting users. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain resolves to the IP address 80.64.19.62, hosted under AS48031 (Ivanov Vitaliy Sergeevich) in Poland, a network frequently associated with fraudulent operations. It was registered on November 23, 2025, through Hosting Concepts B.V. d/b/a Registrar.eu, a registrar commonly exploited for phishing campaigns. The domain lacks an SSL certificate, a critical red flag for secure communication. Security vendors on VirusTotal flagged the domain at a rate of 19/95, and it appears on five security blocklists, including PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB. No entries in Google Safe Browsing (GSB) were noted at the time of assessment, though this may reflect detection latency rather than absence of risk. As of the latest assessment, trustwallet-app.io has been taken offline, reducing immediate exposure to end users. However, the infrastructure remains a latent threat, as domains registered through compromised or lax registrars can be rapidly redeployed. Response actions should include continued monitoring of the IP range and registrar activity for re-emergence. Users who may have interacted with the domain are advised to revoke any connected wallet permissions, rotate credentials, and scan for unauthorized transactions. The combination of high blocklist prevalence, absence of SSL, and association with a known malicious ASN underscores the need for heightened vigilance in cryptocurrency-related phishing threats.