trustwalletmco[.]com

This domain, trustwalletmco.com, is flagged as a brand_impersonation threat specifically targeting Trust Wallet, a widely used cryptocurrency wallet service. Analysis indicates the domain was designed to deceive users into believing they are interacting with the legitimate Trust Wallet platform, likely to harvest credentials, private keys, or facilitate unauthorized transactions. The page title 网站筹建中 (translated as 'Website under construction') suggests an attempt to mask malicious intent while the infrastructure was prepared for active exploitation. No explicit drainer kit signatures were identified in the available data, but the domain's characteristics align with common phishing tactics used in cryptocurrency fraud schemes. Infrastructure analysis reveals multiple technical indicators confirming the domain's malicious nature. The domain was registered through Gname.com Pte. Ltd. on February 21, 2026, an unusually future-dated creation that may indicate an attempt to evade immediate detection or scrutiny. It resolves to the IP address 45.207.200.164, hosted on AS8796 (FASTNET DATA INC) in the United States. VirusTotal reports 12 out of 95 security vendors flagging the domain as malicious, while it appears on at least one security blocklist (PhishDestroy). The domain's SSL certificate is issued by Let's Encrypt (R13), a common choice among threat actors due to its free and automated issuance process. Google Safe Browsing (GSB) status is not explicitly provided, but the presence on a dedicated blocklist and the VirusTotal detection rate underscore its elevated risk profile. As of the latest assessment, trustwalletmco.com has been taken offline, reducing immediate exposure to end users. However, the domain's infrastructure remains a latent threat, as it could be reactivated or repurposed for future campaigns. The registrar and hosting provider have not publicly disclosed takedown actions, leaving the domain's administrative control intact. Users who may have interacted with the domain are advised to revoke any associated wallet permissions, rotate credentials, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its resolving IP address to prevent potential re-emergence. The future-dated registration and the use of a generic 'under construction' page suggest the campaign may have been in an early deployment phase, warranting continued vigilance for similar domains leveraging the same infrastructure or tactics.