trustwnallet[.]com

On July 23, 2026 the domain trustwnallet.com was observed as an offline site that attempted to impersonate the Trust Wallet mobile application. The domain was registered on April 26, 2025 through West263 International Limited and resolves to the IPv4 address 156.243.14.66, which is allocated to CNSERVERS LLC in Hong Kong under ASN 40065. No SSL certificate was presented, indicating that the site operated over plain HTTP. The web server identified as Nginx delivered content that included the page title “Trust钱包下载_Trust安卓版下载_Trust钱包安卓版下载_Trust钱包app下载-全球领先的数字货币交易钱包”, confirming the use of Chinese keywords related to Trust Wallet.

Detected client‑side technologies include Swiper, HSTS and HTTP/3. The authoritative nameservers are ns1.myhostadmin.net through ns4.myhostadmin.net. Security‑vendor scanning on VirusTotal reported 15 of 95 engines flagging the domain as malicious, and the site appears on six public blocklists, with active blocks from PhishDestroy, MetaMask, Polkadot, SEAL and Enkrypt. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious classification.

The evidence points to a crypto‑scam campaign that distributes a counterfeit Trust Wallet download page, likely intended to harvest credentials or install malicious binaries. Uncertainty remains regarding the exact payload delivered to victims, as the site is no longer reachable for content analysis. Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP address for any resurgence, and add the domain to internal blacklists. Incident response teams should also watch for related domains registered by the same registrar or using the same nameserver set, as the infrastructure pattern suggests reuse across multiple campaigns.