trustwalletx[.]online

trustwalletx.online was observed on 2026-07-12 serving an HTTP 200 response with the generic title “Default page”. The site remains active and resolves to the IPv4 address 82.29.191.44, which is geolocated to the United Kingdom and hosted by Hostinger. Registration occurred on May 16, 2026 through Hostinger operations (UAB), and the domain uses the nameservers aurora.dns-parking.com and nebula.dns-parking.com. The TLS certificate is issued by Let’s Encrypt (R12) and the site advertises HTTP/3 support, Hostinger CDN, and Google Analytics.

Infrastructure analysis shows the domain appears on three public blocklists and is listed in an AlienVault OTX pulse. VirusTotal reports that 3 of 95 scanned security vendors flag the domain as malicious, while Gridinsoft assigns a trust score of 0 out of 100. The domain is actively blocked by PhishDestroy, MetaMask, and SEAL, confirming its classification as a brand‑impersonation campaign targeting Trust Wallet users.

The threat actor leverages the trusted Trust Wallet brand to lure victims, likely presenting counterfeit login interfaces or wallet recovery pages. The presence of a default landing page suggests the site may be in a staging phase or using a generic placeholder while malicious payloads are delivered through deeper paths. No additional payload indicators, such as malicious scripts or redirection URLs, have been publicly disclosed, leaving the exact attack vector uncertain.

Defenders should add 82.29.191.44 and the domain trustwalletx.online to network‑level deny lists, monitor DNS queries for the associated nameservers, and enforce TLS inspection to detect any credential‑stealing forms. Users should be warned that any unsolicited request to enter Trust Wallet credentials at this domain is illegitimate, and organizations should educate end‑users to verify official Trust Wallet URLs before providing sensitive information.