trust-wallet[.]cyou

The domain trust-wallet.cyou was identified as a high-risk brand impersonation threat targeting Trust Wallet, a cryptocurrency wallet service. Analysis confirms the domain was actively used to deceive users into believing they were interacting with the legitimate Trust Wallet platform. As of the latest verification, the domain has been taken offline, though prior activity remains a concern for historical exposure. Infrastructure analysis reveals the domain was registered on May 14, 2026, through Global Domain Group LLC. It resolved to the IP address 104.248.137.19, hosted by DigitalOcean, LLC in Germany. The domain was flagged by 12 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. Additionally, it appeared on three security blocklists and was proactively blocked by multiple threat intelligence feeds. The SSL certificate was issued by Let's Encrypt (identifier: E7), a common tactic to lend false legitimacy to phishing infrastructure. The page title, "Lexa — Your English Coach," further suggests an attempt to obfuscate the true intent of the domain. Current status confirms the domain is offline, though residual risk persists for users who may have interacted with it during its active period. Organizations and individuals are advised to block the domain and its associated IP (104.248.137.19) at the network level. Users who accessed the domain should assume potential exposure of sensitive credentials or wallet details and take immediate remediation steps, including revoking access to any linked accounts, rotating passwords, and monitoring for unauthorized transactions. Security teams should review logs for connections to the domain or IP to identify compromised endpoints.