global-multichain[.]com

Analysis of the domain global-multichain.com indicates a targeted brand‑impersonation campaign aimed at Trust Wallet users. The domain was registered on 21 February 2026 and resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site’s SSL certificate is identified as WE1, suggesting a standard TLS deployment without anomalous certificate attributes. The page title returned from the server is "Trust Wallet," directly matching the targeted brand and reinforcing the impersonation intent.

The domain appears on four security blocklists and has been actively blocked by threat‑mitigation services including PhishDestroy, Polkadot, Enkrypt, and Codeesura, all of which have flagged it as a malicious resource. AlienVault OTX records the domain in a single threat‑intelligence pulse, providing an additional external correlation. VirusTotal reports that the domain was scanned by 93 security vendors; none of the scanners raised a detection at the time of analysis, though the absence of detections does not constitute a safety guarantee. The campaign is classified as a crypto‑scam, consistent with the Trust Wallet brand focus and the use of Cloudflare infrastructure to obscure the true hosting environment.

Current observations show the domain is offline, limiting immediate exposure but preserving the risk of re‑activation. Defenders should continue to monitor the domain’s DNS resolution and blocklist status, enforce strict URL filtering for any references to "Trust Wallet" from untrusted sources, and consider adding the domain to internal deny lists. Incident response teams should also review any user reports of unsolicited Trust Wallet‑related communications that may reference this domain, and capture network traffic for potential re‑use of the same IP range in future campaigns.