multichain-app[.]com

Analysis of multichain-app.com indicates an active brand impersonation campaign targeting Trust Wallet users. The domain was registered on February 21, 2026 through GMO Internet Group, Inc. d/b/a Onamae.com and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The site is served by Nginx/OpenResty and presents the page title "Trust Wallet," directly matching the targeted brand. SSL is provided by a Go Daddy Secure Certificate Authority - G2 certificate issued by GoDaddy.com, Inc., suggesting the use of a legitimate‑looking TLS configuration.

Infrastructure signals include nameservers ns1.verification-hold.suspended-domain.com and an incomplete ns2 entry, both of which are atypical and may indicate a temporary or disposable hosting setup. Reputation metrics are extremely poor: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on four security blocklists. VirusTotal reports two of ninety‑three scanning engines flagging the domain, reinforcing the suspicion of malicious intent. Multiple threat intelligence feeds have already blocked the domain, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, confirming consensus among defensive products.

The campaign is classified as a crypto scam, aligning with the Trust Wallet impersonation. Defenders should immediately add multichain-app.com to URL filtering and DNS blocklists, enforce TLS inspection to detect the Go Daddy certificate chain, and monitor outbound connections to the Cloudflare‑hosted IP for unexpected traffic. Continuous hunting for related indicators—such as the specific nameserver pattern and the Nginx/OpenResty stack—can help surface additional replicas. Given the low trust score and existing blocklist presence, the domain should be treated as high‑risk and isolated from user environments pending further forensic analysis.