swaps-trustwallet[.]com

Analysis of swaps-trustwallet.com shows it is a newly registered domain (created 06 Mar 2026) that directly targets the TrustWallet brand. The domain resolves to 172.66.138.67, an address owned by Cloudflare (AS13335) and is served from the United States. Cloudflare is also the registrar and provides the authoritative name servers emerie.ns.cloudflare.com and nero.ns.cloudflare.com. The site presents a TLS certificate issued by Let’s Encrypt (E8), which is typical for a wide range of legitimate and malicious sites and does not in itself indicate trust.

HTTP requests return a 403 status and the only visible page title is “Just a moment…”, suggesting that the content is being blocked or that a challenge page is presented. The domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, confirming that threat‑intel feeds have classified it as malicious. VirusTotal reports three detections out of ninety‑four scanners, further corroborating its malicious nature. The intelligence tags the activity as a crypto‑scam that impersonates TrustWallet, a common technique used to harvest private keys or lure victims into sending cryptocurrency.

Because the site is currently taken offline, live payloads cannot be observed, leaving the exact phishing landing page or credential‑capture mechanism unknown. Defenders should continue to block the domain at network perimeters, update DNS‑filtering rules, and monitor for any resurgence of the host or similar look‑alike domains. Additional mitigation steps include adding the IP address 172.66.138.67 to deny lists, ensuring endpoint protection solutions are aware of the three vendor detections, and reviewing any recent TrustWallet‑related alerts for possible victimization. Continuous review of Cloudflare‑registered domains that mimic TrustWallet is recommended, as the infrastructure can be rapidly re‑used for new campaigns.