trends-trustwallet[.]com

The domain trends‑trustwallet.com was registered on 22 June 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 104.16.219.229, advertised under ASN 13335 (Cloudflare, Inc.) with a geolocation in the United States. The site presents the page title “Best Crypto Wallet for Web3, NFTs and DeFi | Trust Wallet”, directly mirroring the legitimate brand’s marketing copy. The site serves content over HTTPS using a Google Trust Services / WE1 certificate and returns HTTP 200 for the root path, indicating a fully operational web server. Stack analysis reveals a modern stack comprising Node.js, Envoy, React, Next.js, HSTS, Google Tag Manager and Cloudflare Browser Insights, all typical of high‑performance front‑ends. Reputation scoring is extremely low, with Gridinsoft assigning 0/100, and VirusTotal reporting that 2 of 95 scanned security vendors flag the domain as malicious. The domain is actively listed on three public blocklists and is already blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the classification as a high‑risk brand‑impersonation campaign. The nameservers karsyn.ns.cloudflare.com and rocco.ns.cloudflare.com confirm the continued use of Cloudflare’s DNS services. No additional payload or credential‑harvesting infrastructure has been publicly disclosed, leaving the exact user‑impact pathway uncertain. Defenders should add trends‑trustwallet.com to URL filtering and DNS sinkhole rules, enforce TLS inspection to capture any credential submission, and monitor outbound connections to the 104.16.219.229 address for anomalous patterns. Continuous re‑evaluation is advised, as the infrastructure can be replicated on other Cloudflare nodes, and threat actors may modify the front‑end while preserving the brand‑impersonation vector.