trustwalletlnv[.]com

trustwalletlnv.com was registered through Gname.com Pte. Ltd. on 24 October 2025 and currently resolves to the IPv4 address 38.55.19.52, which belongs to AS8796 FASTNET DATA INC located in the United States. The hosting environment presents an Nginx web server with HTTP/3 enabled and enforces HTTP Strict Transport Security. The site presented a valid Let's Encrypt certificate (R13) at the time of capture, indicating that TLS negotiation succeeded. An HTTP 200 response was returned for the root URL, and the page title length was recorded as 530 characters, suggesting a potentially long or malformed title string. The domain is listed as impersonating the Trust Wallet brand and is classified as a crypto‑scam type of abuse.

Threat intelligence from VirusTotal shows that 15 of 95 scanning engines flagged the domain, and the site is currently blocked by the PhishDestroy blocklist as well as one additional security blocklist. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The domain appears on a single known blocklist, but the presence of multiple vendor detections indicates a consensus of malicious intent. The registrar and nameserver configuration (B5.SHARE‑DNS.NET, A5.SHARE‑DNS.COM) are typical of disposable or low‑cost hosting services used by threat actors.

Because the site is now taken offline, active exploitation is not observable, yet the infrastructure remains in place and could be re‑activated. Defenders should add 38.55.19.52 and the associated ASN to network‑level deny lists, monitor the registrar Gname.com Pte. Ltd. for future registrations of similar domains, and ensure that endpoint protection solutions reference the current VirusTotal detection count. Email gateways and web proxies should block any URLs containing the exact domain string and flag any traffic that attempts TLS handshakes with the Let's Encrypt certificate fingerprint observed for this host.