trustwallet-enter[.]id

On July 23, 2026, the domain trustwallet-enter.id was observed hosting a website that presented the page title “Official” and explicitly impersonated the Trust Wallet brand. The site was classified as a crypto‑scam and listed as a brand‑impersonation threat with an elevated risk rating. Technical analysis shows the domain resolves to the IPv4 address 45.61.136.166, which belongs to AS399629 (BL Networks) and is geolocated in the United States. The authoritative name servers are ns1.sectigoweb.com, ns2.sectigoweb.com, ns3.sectigoweb.com and ns4.sectigoweb.com. No TLS certificate was presented, indicating that the site was served over plain HTTP only.

The Gridinsoft trust score for the domain is 0 out of 100, reflecting a complete lack of trust. VirusTotal scans recorded 12 detections out of 95 engines, confirming that multiple security vendors consider the domain malicious. The domain has been added to at least one external blocklist and is actively blocked by the PhishDestroy service, which suggests that defensive feeds have already taken action. The site was taken offline at the time of reporting, and no current HTTP response could be retrieved. The available evidence confirms the existence of a brand‑impersonating crypto‑scam infrastructure, but the lack of an active TLS certificate, the offline status, and the absence of publicly shared page content limit deeper forensic insight.

Analysts cannot verify whether the site hosted credential‑stealing forms, cryptocurrency address redirects, or additional malicious payloads. The registration details are limited to the hosting ASN and do not reveal the registrar or registrant identity, further obscuring attribution. Defenders should continue to block the domain and its associated IP address in perimeter and endpoint controls, ensure that threat‑intelligence feeds incorporate the observed nameserver set, and monitor for any re‑registration of the domain or reuse of the IP range by similar campaigns.