trustwalletteam[.]us

This domain, trustwalletteam.us, poses a high-risk brand impersonation threat targeting Trust Wallet users. The site mimics the official Trust Wallet interface, presenting itself as "Best Crypto Wallet for Web3, NFTs and Defi | Trust Team USA" to deceive visitors into entering sensitive credentials, such as wallet recovery phrases or private keys. The primary objective is credential harvesting, enabling attackers to gain unauthorized access to cryptocurrency wallets and drain funds. The domain employs social engineering tactics, leveraging the Trust Wallet brand's reputation to lower user vigilance and increase the likelihood of successful compromise.

Analysis of the domain's infrastructure reveals multiple indicators of malicious activity. The domain was registered on May 21, 2025, through Dynadot LLC, with hosting provided by OVH SAS (AS16276) in France, resolving to IP address 51.210.113.204. Security vendor detections on VirusTotal indicate 15 out of 95 engines flag the domain as malicious, specifically for phishing. Google Safe Browsing has also classified the domain as a phishing site. Additionally, the domain appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt (R13), does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. The domain has since been taken offline, but its prior activity and infrastructure remain concerning.

Users who visited trustwalletteam.us should take immediate action to mitigate potential risks. If any credentials, recovery phrases, or private keys were entered on the site, assume they have been compromised. Immediately transfer any remaining assets from the affected wallet to a new, secure wallet with a fresh recovery phrase. Enable multi-factor authentication on all associated accounts where possible. Monitor financial and account activity for unauthorized transactions, and report any suspicious activity to relevant platforms. Additionally, scan the device used to access the domain for malware, as phishing sites may deploy additional payloads. Users are advised to remain vigilant for similar impersonation attempts and verify domain authenticity before entering sensitive information.