zh-trustwallet[.]cn

This domain is flagged as an elevated-risk brand impersonation site specifically targeting Trust Wallet, a cryptocurrency wallet service. Analysis indicates the site is designed to deceive users into disclosing sensitive credentials or transferring digital assets under false pretenses, a tactic commonly associated with crypto drainer operations. The infrastructure and registration patterns align with known malicious campaigns aimed at exploiting trust in established crypto brands. Infrastructure analysis reveals the domain www.zh-trustwallet.cn resolves to IP address 156.243.14.8, hosted on AS40065 (CNSERVERS LLC) in Hong Kong. The domain was registered on March 01, 2026, through WEST263 INTERNATIONAL LIMITED, a registrar frequently observed in fraudulent registrations. Security vendors on VirusTotal flagged the domain at a ratio of 13/95, indicating moderate consensus on its malicious nature. The site appears on one security blocklist and was actively blocked by PhishDestroy. The SSL certificate, issued by TrustAsia Technologies, Inc. under LiteSSL RSA CA 2025, does not mitigate the risk, as malicious actors commonly use valid certificates to lend false legitimacy to phishing sites. The page title, 'Home,' suggests an attempt to mimic the minimalist design of legitimate wallet interfaces. Mitigation steps for organizations and end-users include immediate blocking of the domain and its associated IP (156.243.14.8) at the network perimeter. Security teams should update endpoint protection rules to detect and prevent access to this domain, particularly in environments where cryptocurrency transactions are common. Users who may have interacted with the site should be advised to revoke any connected wallet permissions, rotate credentials for associated accounts, and monitor transaction histories for unauthorized activity. Given the domain's current offline status, continuous monitoring for re-emergence or similar impersonation domains (e.g., typosquatting variants) is recommended. Cryptocurrency service providers should proactively alert users to this threat and reinforce awareness of brand impersonation tactics targeting wallet credentials.