trustaws[.]com

Analysis indicates that trustaws.com is an active phishing domain targeting cloud-service credentials, registered on July 26, 2026, through Fewmoretaps OU operating under the alias Trustname.com. The domain resolves to IP address 54.39.106.37, hosted by OVH Hosting, Inc. in Canada, and is currently flagged by three security blocklists, including PhishDestroy, MetaMask, and SEAL. Infrastructure analysis reveals the use of nameservers ares.trustname.com, ns1.anycastdns.cz, ns2.anycastdns.cz, and zeus.trustname.com, suggesting a reliance on bulletproof or low-reputation DNS providers.

The SSL certificate is issued by Let's Encrypt (YR2), a common choice among threat actors due to its low barrier to acquisition and short validity periods. VirusTotal telemetry shows a single detection from 91 security vendors, indicating limited but present awareness of the threat. The domain's registration age—just two days old at the time of this report—aligns with typical phishing campaign timelines, where domains are rapidly deployed and discarded.

No specific brand impersonation details or page content analysis are available at this stage, though the domain name suggests a focus on Amazon Web Services (AWS) credential harvesting. Defenders should treat this domain as high-risk and prioritize blocking at the DNS, network, and endpoint layers. Organizations using AWS or similar cloud platforms are advised to monitor for unauthorized access attempts linked to this domain and enforce multi-factor authentication for all credential submissions.