pay-trustwallet[.]com

pay-trustwallet.com was registered on 2025-09-09 through Web Commerce Communications Limited and is hosted on Cloudflare’s network (ASN 13335, IP 104.21.61.176, United States). The domain resolves to Cloudflare edge servers identified by the nameservers elinore.ns.cloudflare.com and rudy.ns.cloudflare.com, but it does not present a valid SSL certificate, leaving HTTP connections unencrypted. The only visible page element is the HTML title “Trust Wallet”, which directly mirrors the official TrustWallet brand name and aligns with the reported crypto‑scam classification. VirusTotal analysis shows that five of ninety‑five scanning engines flagged the domain, indicating a non‑trivial detection rate that corroborates its malicious intent.

The domain appears on a single external security blocklist and has been actively blocked by PhishDestroy, reinforcing its identification as a harmful resource. Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of confidence in the site’s legitimacy. Current status is offline, which prevents direct observation of any phishing payload or credential‑capture mechanisms, leaving the exact content and tactics of the site unverified. Nonetheless, the combination of brand impersonation, lack of TLS, low trust score, and multiple vendor detections provides sufficient evidence for defensive action.

Defenders should add pay-trustwallet.com to local and network‑wide blocklists, monitor DNS queries for the domain and its associated IP, and enforce TLS inspection policies to detect any future re‑hosting attempts. Users of TrustWallet should be reminded that the legitimate service never uses URLs containing “pay-trustwallet.com” and that any unsolicited communications requesting wallet credentials are likely fraudulent. Continuous threat‑intel feeds should be consulted for any re‑appearance of the domain or related infrastructure, and any observed traffic should be logged for forensic analysis.