trust-wallet[.]claims
“TWT Token Airdrop: Complete Missions and Get Rewarded”
trust-wallet.claims — Konten tidak tersedia (HTTP 502). Peniruan identitas merek: Trust Wallet; Jenis penipuan: Wallet/seed Phishing. Ringkasan bukti: VirusTotal 12/95 (alphaMountain.ai, BitDefender, CyRadar, ESET, Forcepoint ThreatSeeker); 4 external blocklist matches; PhishDestroy score 86/100. Registrar: GIR_SER-NET (ASN: 2077….
Analisis terperinci PhishDestroy AI di bawah tetap berbahasa Inggris untuk menjaga catatan forensik asli.
The domain trust-wallet.claims was observed delivering a wallet‑seed phishing campaign that masquerades as a TrustWallet airdrop. The site presented the page title “TWT Token Airdrop: Complete Missions and Get Rewarded” and employed the publicly available Airdrop Scam phishing kit. Technical analysis shows the domain resolves to the IPv4 address 213.165.61.42, which is allocated to AS207713 (GLOBAL INTERNET SOLUTIONS LLC) in Russia. The authoritative nameservers are a.dnspod.com, b.dnspod.com, and c.dnspod.com, and the registration was performed through the GIR_SER‑NET registrar, linking the infrastructure to ASN 207713.
No TLS certificate is presented; the site served only HTTP, reducing the possibility of encrypted traffic inspection. VirusTotal listed the domain in 12 of 95 security vendor checks, and five independent blocklists have already added the host. Additional defensive feeds—including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura—have flagged the domain as malicious. The service has been taken offline at the time of reporting, and no further HTTP response was captured, limiting visibility into the exact payload delivered beyond the page title.
The evidence confirms a targeted impersonation of the TrustWallet brand, specifically aiming to harvest cryptocurrency wallet seeds under the guise of an airdrop. Defenders should add the domain and its resolved IP address to network‑level denial lists, monitor DNS queries for the associated dnspod.com nameservers, and ensure endpoint protection retains the 12 vendor detections for future correlation. Continuous observation of ASN 207713 activity is advised, as related infrastructure may be reused in subsequent campaigns.
Alur Tanggapan Ancaman Pipeline
Status Daftar Blokir Publik
Tangkapan tersimpan
Intelijen Domain
Rincian teknisDNS, SAN SSL, cap waktu
ICANN OVERSIGHT
Akreditasi dan konteks RAA
Akreditasi dan konteks RAA
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Analisis VirusTotal
Bukti & Laporan Eksternal
“Phishing website!”
Apakah Anda Terpengaruh oleh Situs Ini?
Jika Anda memasukkan kredensial akun, informasi pribadi atau pembayaran, atau mengunduh file dari domain ini, segera ambil tindakan. Di bawah ini adalah sumber daya untuk membantu Anda melaporkan insiden tersebut dan melindungi diri Anda sendiri.
Laporkan kepada Pihak Berwenang di Daerah Anda
Pilih negara Anda untuk mendapatkan kontak resmi kejahatan dunia maya, atau membuat draf pengaduan →.
Periksa Domain Apa Pun
Analisis ancaman menggunakan daftar blokir yang disimpan, WHOIS, DNS, dan bukti pemindaian publik
Pindai SekarangLaporkan Phishing
Laporkan domain yang mencurigakan ke basis data ancaman kami — lindungi komunitas
LaporanPemberitahuan Ancaman Real-Time
Laporan phishing terbaru dan perubahan ketersediaan yang diamati
PantauTetap Terinformasi, Tetap Aman
Pantau ancaman secara langsung atau ajukan keberatan terhadap daftar ini jika Anda yakin ini merupakan false positive