trustwalletrecovery[.]net

The domain trustwalletrecovery.net was registered on November 07, 2025 through Hostinger operations, UAB. It resolves to the IPv4 address 84.32.84.32, which is announced by AS47583 Hostinger International Limited and geolocated to Lithuania. The domain uses the default parking nameservers ns1.dns-parking.com and ns2.dns-parking.com and presents the page title “Parked Domain name on Hostinger DNS system”. No TLS certificate is associated with the host, indicating that HTTPS connections are not available.

VirusTotal analysis shows that three of ninety‑five scanning engines flagged the domain as malicious, confirming a low‑to‑moderate detection rate across the vendor community. The domain appears on a single external blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing its classification as a threat. Brand‑targeting evidence indicates that the domain is attempting to impersonate the Trust Wallet cryptocurrency wallet, and the overall scam type is identified as a crypto‑related scam. The combination of brand impersonation, lack of encryption, and the parking page suggests that the domain is being used to lure victims into providing cryptocurrency credentials or to host malicious redirects, although the exact payload or page content has not been captured because the site is currently taken offline.

Uncertainty remains regarding the specific phishing kit or the exact mechanics of the scam, as no additional content or HTTP response details are available. Analysts should treat any traffic to the IP address or DNS queries for the domain as suspicious, enforce blocklisting at perimeter defenses, and monitor for any re‑registration attempts. Threat intelligence sharing with partners and updating URL filtering rules to include the domain and its associated IP are recommended. Continuous observation of Hostinger‑hosted infrastructure for similar parking domains may help identify future impersonation campaigns.