trustedwallet[.]help

Analysis of the domain trustedwallet.help indicates it functioned as a crypto drainer phishing site, operational since February 21, 2026, and taken offline by July 25, 2026. The domain was registered through Dynadot LLC and resolved to IP address 186.2.166.73, hosted on AS59692 (IQWeb FZ-LLC) in the United Arab Emirates. Nameservers included pns41.cloudns.net through pns44.cloudns.net, a configuration commonly associated with bulletproof or low-reputation DNS providers. The SSL certificate was issued by PhishDestroy under the issuer botadmin.destroy.tools, a known indicator of phishing infrastructure.

The page title, 'Wallet Verification,' aligns with common crypto scam patterns targeting wallet authentication processes. While the exact content of the site remains unanalysed, the classification as a 'Crypto Scam' and the designation as a crypto drainer threat are supported by its presence on at least one security blocklist and its blocking by PhishDestroy. Gridinsoft assigned a trust score of 0/100, reinforcing its malicious classification. Twelve of 93 security vendors on VirusTotal flagged the domain as malicious, though this detection rate alone does not confirm the full scope of its threat.

Defenders should treat this domain as confirmed malicious infrastructure. The SSL issuer, hosting provider, and DNS configuration provide actionable indicators for blocking or monitoring. Given its offline status, further compromise via this specific domain is unlikely, but related infrastructure—such as domains sharing the same SSL issuer, registrar, or hosting provider—may warrant investigation. No evidence links this domain to a specific brand beyond the 'Wallet Verification' page title, and no additional scam categorisation beyond 'Crypto Scam' is supported by the available data.