walletverify[.]transactionshield[.]info

walletverify.transactionshield.info was registered on May 08, 2026 through a Hostinger‑operated registrar (UAB). The domain resolves to 104.21.14.198, which is part of Cloudflare’s network and uses the nameservers nora.ns.cloudflare.com and uriah.ns.cloudflare.com. The hosting infrastructure is therefore protected by Cloudflare’s CDN and DDoS mitigation services, which can obscure the true origin of the malicious payload.

The web page served by the domain returns an HTTP 302 redirect and presents a title “Transfer Trust Wallet”, directly mimicking the Trust Wallet brand. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, confirming that the connection is encrypted but does not legitimize the content. The page’s visual cues and wording are designed to lure Trust Wallet users into entering their credentials, consistent with a login‑credential phishing kit.

VirusTotal analysis shows that 2 of 95 scanned security vendors flagged the domain, indicating that detection is still limited. Independent blocklists such as PhishDestroy and ScamSniffer have already listed the domain, and Gridinsoft assigns a trust score of 0 out of 100. The threat is classified as a brand‑impersonation phishing login attack with a high risk rating and remains active as of the report date.

Defenders should block the domain and its resolving IP at perimeter firewalls and DNS filtering solutions. Continuous monitoring of Cloudflare‑associated IP ranges for similar redirects is advised, as attackers frequently reuse the same CDN edge. End‑users of Trust Wallet should be warned about the “Transfer Trust Wallet” page and instructed to verify URLs before entering credentials. Incident response teams can capture HTTP traffic for further payload analysis and consider sinkholing the domain if possible.