trusted-wallet[.]info

The domain trusted-wallet.info was registered on February 27, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently taken offline. DNS resolution points to the IPv4 address 85.206.175.144, which belongs to the Lithuanian autonomous system AS61272 (Informacines sistemos ir technologijos, UAB). The domain is served by four nameservers—dns1.bacloud.com, dns2.bacloud.com, dns1.laisvas.lt, and dns2.laisvas.lt—indicating a distributed hosting configuration that spans at least two distinct provider networks. No TLS certificate is presented, meaning all HTTP traffic would be unencrypted if the site were reachable.

The sole page title returned by the web server is "Index of /," providing no functional context and suggesting a placeholder or directory listing rather than a crafted phishing interface. Security tooling has flagged the domain on three independent blocklists and it is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filters, all of which target malicious cryptocurrency‑related activity. VirusTotal analysis shows that two out of ninety‑five antivirus engines have flagged the domain, reinforcing the suspicion of malicious intent. The threat type is catalogued as a crypto drainer, a class of operation that typically lures victims into sending cryptocurrency to attacker‑controlled wallets.

While the offline status precludes real‑time interaction, the infrastructure elements—Lithuanian hosting, publicly listed nameservers, lack of SSL, and the presence on multiple anti‑phishing lists—are consistent with known crypto‑draining campaigns. Defenders should continue to monitor the IP address 85.206.175.144 for any reactivation, enforce outbound transaction controls to block communications with this host, and ensure that endpoint protection solutions reference the latest blocklist entries.