trustwalletwys[.]com

The domain trustwalletwys.com was observed as an offline crypto‑scam infrastructure targeting Trust Wallet users. Registration records show the domain was created on 29 October 2025 through the registrar Gname.com Pte. Ltd. DNS resolution points to the IP address 38.55.19.51, which belongs to AS8796 FASTNET DATA INC and is geolocated in the United States. Network analysis indicates the web server runs Nginx with HTTP/3 enabled and enforces HTTP Strict Transport Security (HSTS). The site presented the page title "网站筹建中", which translates to "Website under construction"; no further page content has been captured. The SSL certificate associated with the host carries an R12 rating, suggesting a low trust level.

Malware and URL reputation scanners on VirusTotal flagged the domain in 14 of 93 security vendor checks, indicating a moderate detection consensus. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service. Independent scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. The overall threat profile aligns with a crypto‑scam campaign that impersonates the Trust Wallet brand, likely aiming to harvest credentials or lure victims into fraudulent transactions.

Uncertainty remains regarding the exact phishing kit or payload, as no samples or page screenshots have been released. Defenders should add the IP address 38.55.19.51 to network‑level deny lists, enforce DNS blocking for the domain, and monitor for any resurgence of the domain or related sub‑domains. Organizations using Trust Wallet should remind users to verify URLs, avoid interacting with sites that display the "网站筹建中" title, and report any suspicious activity to their security teams. Continuous monitoring of VirusTotal, blocklist feeds, and registrar changes is recommended to detect potential re‑registration or new infrastructure linked to this campaign.