trustwallet[.]binance[.]com[.]connecting[.]wallet[.]x4r[.]org

The domain trustwallet.binance.com.connecting.wallet.x4r.org is currently offline but was actively used in a brand‑impersonation campaign targeting Trust Wallet users. Registration data shows the domain was created on February 21, 2026 through Squarespace Domains II LLC, and it resolves to the Cloudflare edge address 188.114.97.3, which is associated with AS13335 Cloudflare, Inc. in the United States. DNS resolution is served by aryanna.ns.cloudflare.com and jonah.ns.cloudflare.com, and the site employed Cloudflare Browser Insights, Cloudflare, and HTTP/3, indicating reliance on Cloudflare’s performance and security services. The TLS certificate was issued by Google Trust Services under the WE1 intermediate, confirming the use of a legitimate certificate chain, but this does not mitigate the malicious intent.

The page title observed during analysis was "Open in TrustWallet," directly referencing the targeted brand. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, all of which have flagged it as a crypto‑related scam. VirusTotal analysis recorded two detections out of ninety‑three security vendors, reinforcing the malicious classification. The campaign is identified as a crypto scam that impersonates Trust Wallet, leveraging the trust of the brand to lure victims.

Defenders should block the domain at the DNS level, add the associated IP address to network‑level deny lists, and ensure that endpoint protection solutions are updated to include the reported blocklist entries. Monitoring for similar sub‑domain patterns that combine high‑profile brand names with additional labels (e.g., "connecting.wallet.x4r.org") is advisable, as the naming convention suggests automated generation of impersonation domains.