trustwalletcertificate[.]in

trustwalletcertificate.in is currently active and returns HTTP 200 responses. VirusTotal scans have flagged the domain by six of ninety‑five security vendors, and Gridinsoft assigns it a trust score of zero out of one hundred, indicating a high likelihood of malicious use. The page title returned by the server matches the domain name itself, providing no additional context. The domain is registered through GoDaddy and uses GoDaddy’s standard SSL certificate issued by Go Daddy Secure Certificate Authority – G2. DNS resolution points to the address 13.248.243.5, which belongs to Amazon Web Services Global Accelerator and is geolocated in Canada. Authoritative nameservers are ns43.domaincontrol.com and ns44.domaincontrol.com, both typical of GoDaddy’s hosting services. Intelligence sources identify the site as a wallet‑phishing operation that impersonates the Trust Wallet brand. It appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. AlienVault OTX references the domain in eight separate threat‑intel pulses, reinforcing the assessment of a coordinated brand‑impersonation campaign. The available data does not include a content analysis of the landing page beyond its title, leaving the exact phishing flow and any credential‑capture mechanisms unverified. Defenders should proactively deny network communication to 13.248.243.5, add the domain and its associated IP to internal blocklists, and monitor for any DNS queries targeting the listed nameservers. Continuous observation of VirusTotal and OTX updates is advised to capture any changes in detection ratios or additional indicators of compromise.