truststonewallet[.]com

Analysis of truststonewallet.com shows a deliberately crafted crypto‑draining operation that was taken offline prior to the report date of July 25 2026. The domain was registered on February 21 2026 through Dynadot LLC and resolves to the IP address 82.29.186.76, which is hosted in Great Britain by Hostinger International Limited (AS47583). The site presented the page title "Trust One Wallet" and employed a stack that includes PHP, Tailwind CSS, LiteSpeed, Alpine.js, and external resources from Unpkg, Smartsupp, jsDelivr, and Hostinger. A Let's Encrypt R12 certificate was active, confirming the use of HTTPS at the time of capture.

Gridinsoft assigned a trust score of 0 out of 100, indicating a lack of legitimacy. The domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a crypto‑related scam. VirusTotal scans recorded three detections out of ninety‑three security vendors, further corroborating malicious intent. Nameservers ns1.dns-parking.com and ns2.dns-parking.com were observed, consistent with a parked or temporary hosting configuration.

While the exact phishing page content was not captured, the combination of the page title, hosting profile, low trust score, blocklist presence, and vendor detections provides strong evidence of a crypto‑drainer campaign targeting wallet users. Defenders should continue to block the domain at DNS and proxy layers, monitor outbound connections to the associated IP range, and update endpoint protection signatures to include the observed vendor detections. Ongoing threat‑intel feeds should be queried for any re‑registration attempts or related infrastructure that may reuse the same IP or hosting provider. The current offline status does not eliminate the risk of rapid re‑deployment, so proactive containment and awareness of the truststonewallet.com indicator remain recommended.