trustwallet-login[.]blogspot[.]com

The domain trustwallet-login.blogspot.com is currently active and has been identified as a crypto drainer that mimics a Trust Wallet login interface. Infrastructure analysis shows the domain resolves to the IP address 142.251.110.132, an address associated with Google’s hosting network. Registration data indicates the domain was created through Google LLC, confirming the use of a legitimate registrar to obscure malicious intent.

VirusTotal scans have recorded eight detections out of ninety‑one participating security vendors, suggesting that multiple independent engines have observed malicious characteristics. Nameserver information is unavailable, as the query returned NS_NOT_FOUND, limiting insight into the domain’s DNS delegation. The domain is listed on three public security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a high‑risk threat.

No public evidence of SSL/TLS configuration, HTTP status codes, or page titles has been published, and Open Threat Exchange (OTX) references are absent, leaving the exact content of the landing page unverified. Defenders should treat the domain as hostile: block DNS resolution, add the IP to network‑level deny lists, and incorporate the eight VirusTotal detections into heuristic rules. Continuous monitoring for any changes in DNS records, additional blocklist listings, or new VirusTotal detections is advised to maintain situational awareness.