trustwallet-com[.]to

This domain is flagged as a high-risk brand impersonation threat targeting TrustWallet, a cryptocurrency wallet service. The site mimics the official TrustWallet interface to deceive users into entering sensitive credentials, such as private keys or recovery phrases, enabling unauthorized access to digital assets. Analysis indicates the domain is designed to exploit trust in the legitimate brand, increasing the likelihood of successful phishing attacks against crypto users. Infrastructure analysis reveals the domain trustwallet-com.to was registered on November 23, 2025, through NiceNIC International Group Co., Limited. It resolves to the IP address 80.64.19.62, hosted in Poland under AS48031 (Ivanov Vitaliy Sergeevich). The domain lacks an SSL certificate, a red flag for secure connections. VirusTotal reports 19 out of 95 security vendors flagging the domain as malicious. It appears on five security blocklists and is actively blocked by PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB. The page title, 'Trust Wallet: Best Crypto Wallet for Mobile & Web3,' closely mirrors the legitimate TrustWallet branding, further confirming its intent to deceive. Mitigation steps for this threat include immediate blacklisting of the domain and its associated IP (80.64.19.62) across all network security controls. Organizations should update endpoint protection rules to block access to the domain and monitor for any residual connections. Users who may have interacted with the site should be advised to revoke access to any linked wallets, rotate credentials, and scan devices for malware. Given the domain's current offline status, continuous monitoring is recommended to detect potential re-emergence or similar impersonation attempts targeting TrustWallet or other crypto services.