tron-trustwallet[.]com

Analysis of the domain tron-trustwallet.com, observed on July 22 2026, indicates it is being used for a brand‑impersonation campaign targeting Trust Wallet users. The domain was registered on February 26 2026 through NiceNIC International Group Co., Limited and is served from the IP address 104.21.69.84, which belongs to Cloudflare, Inc. (AS13335) and resolves to a United States location. No TLS certificate was presented, leaving the HTTPS handshake unencrypted and further suggesting the site was not intended for legitimate secure communication. The HTTP response includes the page title “Just a moment…”, a generic placeholder often associated with Cloudflare challenge pages rather than a functional login interface.

Infrastructure details show the domain uses Cloudflare’s authoritative name servers jeff.ns.cloudflare.com and naomi.ns.cloudflare.com, a common choice for fast‑flux or disposable phishing sites. Independent security aggregators have placed the domain on three blocklists, specifically PhishDestroy, MetaMask, and SEAL, confirming its detection by multiple anti‑phishing services. VirusTotal scans reported that two of ninety‑three antivirus engines flagged the domain, providing additional corroboration of malicious intent despite the relatively low detection count. The campaign is classified as a crypto scam, with the brand target explicitly listed as Trust Wallet, indicating that victims may be lured into disclosing private keys, seed phrases, or transferring cryptocurrency.

Current host status is offline, which may be a temporary takedown or a deliberate removal after a short‑lived operation; the lack of a live endpoint prevents further behavioral analysis. Uncertainties remain regarding the specific phishing page content, any payload delivery mechanisms, and whether the domain was part of a larger infrastructure sharing the same IP or name‑server configuration.