m[.]fuyuandiyizhongxue[.]com

The domain m.fuyuandiyizhongxue.com was registered on March 13, 2026 through West263 International Limited. It resolves to the IP address 210.16.177.40, which belongs to AS146817 operated by Hubei Feixun Network Co., Ltd in China. The site presents a page titled “TrustWallet官网下载-TrustWallet钱包最新版本下载-安全加密钱包,支持比特币和以太坊区块链钱包”, directly mimicking the official TrustWallet download portal. Infrastructure analysis shows the domain uses the authoritative name servers ns1.365.hk and ns2.365.hk. The web server is Nginx with HTTP/3 enabled, serving content over a valid Let's Encrypt R13 certificate. Detected front‑end libraries include Bootstrap, Slick, jQuery, and the site enforces HTTP Strict Transport Security. An HTTP GET returns status 200, indicating the page is actively reachable. Threat intelligence flags this domain as a brand‑impersonation campaign targeting TrustWallet users. It appears on one security blocklist and has been listed by PhishDestroy. VirusTotal scans show three of ninety‑five AV engines flag the domain, suggesting limited but non‑trivial detection. The Gridinsoft trust score of 0/100 further confirms a malicious classification. The combination of a trusted‑looking title, a valid TLS certificate, and the use of popular web frameworks is typical of credential‑harvesting sites that aim to evade automated detection. Defenders should treat the domain as high‑risk and block network traffic to 210.16.177.40 at the perimeter. Email gateways and web filters ought to include the full hostname in deny lists, and security teams should monitor DNS queries for the 365.hk name servers as an indicator of related infrastructure. Users of TrustWallet should be warned not to download software from this URL and to verify official sources. Continuous re‑scanning of the host and periodic review of blocklist updates are recommended to capture any changes in the site's behavior.