trustwallet-transactions[.]com

This domain is flagged as a high-risk brand impersonation threat targeting TrustWallet, a cryptocurrency wallet service. Analysis indicates the domain is designed to deceive users into believing it is an official TrustWallet transaction portal, likely to facilitate credential harvesting or crypto asset theft. The threat type is classified as brand impersonation, a tactic commonly used to exploit user trust in established brands for malicious purposes.

Infrastructure analysis reveals the domain was registered on June 24, 2026, through Cloudflare, Inc., and currently resolves to the IP address 216.198.79.65, hosted on Amazon.com, Inc. infrastructure (AS16509). Detection metrics show minimal coverage, with only 1 out of 95 security vendors on VirusTotal flagging the domain as malicious. The domain appears on a single security blocklist (PhishDestroy) and remains active as of this report. The SSL certificate is issued by Let's Encrypt (YR1), a common certificate authority used by both legitimate and malicious domains.

Mitigation steps for this threat include immediate blocking of the domain and its associated IP address (216.198.79.65) at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to this domain, particularly in environments where cryptocurrency transactions are conducted. User awareness training should emphasize verifying domain authenticity before entering credentials or interacting with transaction portals. Additionally, monitoring for similar domain registrations (e.g., typosquatting variants of TrustWallet) is recommended to preemptively identify related threats.