trustwalletdappverification[.]buzz

PhishDestroy identifies trustwalletdappverification.buzz as an active brand impersonation domain targeting Trust Wallet users, operating as a crypto asset drainer. The domain was purpose-built to deceive visitors into connecting malicious cryptocurrency wallets under the guise of a legitimate application verification portal. Threat actors leveraged a familiar branding scheme—Trust Wallet—to lower user suspicion and increase the likelihood of successful credential or wallet compromise. No known drainer kit artifacts were publicly disclosed at time of analysis, indicating either a lightweight or highly obfuscated implementation.

This domain was flagged with a VirusTotal detection score of exactly 8 out of 95 security vendors as of latest scan, indicating moderate but rising suspicion across multiple engines. It was registered through PDR Ltd. d/b/a PublicDomainRegistry.com, with a creation timestamp of April 16, 2026. The domain resolves to IP address 104.21.82.34 and utilizes a Let's Encrypt SSL certificate to mimic legitimate web traffic encryption. At the time of analysis, the domain was not flagged in Google Safe Browsing (GSB), and had accumulated at least 3 active blocklist entries across threat intelligence platforms. The recent registration date suggests an opportunistic campaign with low operational maturity.

As of this advisory, the domain remains active and poses an elevated threat level due to its impersonation of a widely used crypto wallet brand and high-risk functionality. Immediate response actions include blocking the domain at DNS and network levels, flagging the associated IP and SSL certificate, and adding the domain to threat intelligence feeds. While the risk is elevated due to its specificity and active status, the relatively low VT detection score and absence from GSB suggest it may not yet be widely recognized by all security vendors. Users are strongly advised to avoid interacting with this domain, verify any wallet-related sites through official Trust Wallet channels, and report suspicious domains via PhishDestroy for rapid takedown and community protection.