trustwalletfix[.]info

Analysis of trustwalletfix.info, observed on July 24, 2026, indicates a brand‑impersonation campaign targeting Trust Wallet users. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare edge address 172.67.183.160, located in the United States under ASN 13335 (Cloudflare, Inc.). DNS resolution is delegated to will.ns.cloudflare.com and luciana.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure and the presence of HTTP/3 support. The site presents the page title “Just a moment…”, a generic placeholder often associated with Cloudflare‑protected pages, and no additional content has been captured.

SSL/TLS termination is performed by Google Trust Services under the WE1 certificate, further confirming its reliance on Cloudflare’s proxy services. VirusTotal scans show three of ninety‑three security vendors flagging the domain, indicating at least a minority of detection engines recognize malicious activity. The domain appears on a single external blocklist and has been specifically blocked by the PhishDestroy feed, reinforcing its classification as a crypto‑related scam. The intelligence tags the campaign as a “Crypto Scam”, consistent with the Trust Wallet brand impersonation.

While the precise credential‑collection mechanisms have not been publicly disclosed, the infrastructure choices—Cloudflare CDN, shared IP space, and a legitimate Google‑issued certificate—are typical of throwaway domains used to evade static reputation checks. Defenders should add the IP 172.67.183.160 and the domain trustwalletfix.info to network‑level deny lists, monitor for DNS queries to the associated Cloudflare nameservers, and enforce URL filtering against known phishing feeds that include PhishDestroy entries. Continuous re‑scanning on VirusTotal and other multi‑engine platforms is recommended to capture any future detection updates.