trustwalletconnect[.]net[.]trustalpha[.]net

The domain trustwalletconnect.net.trustalpha.net was registered on February 21 2026 and is currently taken offline. Analysis shows it was created by the registrar Ultahost, Inc., which also provides the authoritative name servers ns1.ultahost.com through ns4.ultahost.com. DNS resolution points the domain to IP address 192.142.10.5, an address allocated to Ultahost, Inc. in the Netherlands under AS214036. No TLS certificate was observed for the site, indicating that any HTTP service would have been delivered without encryption.

The page title returned from the host was "Alpha - Build the Future of Web3," which does not reference the targeted brand. The domain is explicitly listed as an impersonation of Trust Wallet, a cryptocurrency wallet service, and is classified as a crypto‑scam type. Detection telemetry shows that 9 of 93 security vendors on VirusTotal flagged the domain, and it appears on one external security blocklist. PhishDestroy has already blocked the domain, and it is recorded as offline at the time of this report.

While the exact malicious payload or credential‑harvesting mechanisms have not been publicly disclosed, the combination of brand impersonation, the crypto‑scam label, and the observed vendor detections indicate a credible threat. Defensive teams should continue to block the domain at network perimeter devices, update URL filtering policies, and monitor for any residual traffic to 192.142.10.5. Further investigation of any associated URLs or files that may have been distributed before takedown is recommended, as is verification that endpoint protection solutions have incorporated the 9 vendor detections into their signatures.