trust-wallet-unlock[.]24net[.]sbs

The domain trust-wallet-unlock.24net.sbs is currently active and has been identified as a brand‑impersonation site targeting Trust Wallet users. Infrastructure analysis shows the zone is hosted on the ns103.asurahosting.com and ns104.asurahosting.com name servers. DNS resolution points to IP 198.251.81.49, which is assigned to FranTech Solutions in the United States. Registration information indicates the domain was created through TuringSign Inc., operating under the trade name Cosmotown. The HTTP response returns status code 200, indicating a live web service, and the domain is listed on a single security blocklist. PhishDestroy has already added the domain to its blocklist, providing early mitigation for customers that rely on that feed. VirusTotal scans have not produced any vendor detections, but the absence of a detection does not confirm benign intent. Evidence confirms the domain’s purpose is brand impersonation, but the exact page content has not been disclosed in the available intelligence, leaving the specific phishing vector and credential‑capture mechanisms uncertain. Defenders should block the domain at network perimeter and DNS layers, monitor for outbound connections to 198.251.81.49, and include the associated name servers in any sink‑hole or threat‑intel feeds. Continuous re‑evaluation is advised, as the site may evolve its payload or landing pages.