claim-trustswallet[.]glfts-networks-app[.]eu[.]org

Analysis indicates that claim-trustswallet.glfts-networks-app.eu.org is currently active and serves content with HTTP 200 status. The site presents the page title “TrustWallet”, matching the brand target Trust Wallet, and is listed as a crypto‑scam. Infrastructure observation shows the domain resolves to IP 198.18.2.86 and is hosted behind an Nginx/OpenResty web server employing Ant Design and jQuery front‑end libraries. The TLS certificate is issued by Google Trust Services under the WR1 designation, which does not provide any brand validation beyond standard domain validation. Domain registration dates back to August 9 1995 and was performed through Gandi SAS. Nameserver configuration includes ns1.eu.org, ns.bortzmeyer.eu.org, and hobbes.bsd-dk.dk, a set frequently observed in malicious infrastructure. Threat intelligence records indicate that the domain is actively impersonating Trust Wallet, is categorized as a crypto‑scam, and appears on a single security blocklist, blocked by PhishDestroy. Four of ninety‑five VirusTotal scanners have flagged the domain, and Gridinsoft assigns a trust score of 0/100, reinforcing the malicious assessment. While the exact phishing kit or payload is not disclosed, the combination of brand impersonation, low trust scores, and inclusion on a blocklist suggests a high‑risk profile. Defenders should block the domain at network perimeter, add it to DNS sinkhole lists, monitor outbound connections to the IP 198.18.2.86, and educate users about unsolicited requests claiming to be from Trust Wallet. Continued observation is advised to detect any changes in hosting or content.