trustaml[.]net

Analysis of trustaml.net shows a high‑risk brand‑impersonation campaign targeting Trust Wallet users. The domain was registered on 21 February 2026 through OwnRegistrar, Inc. and resolves to IP 146.103.40.121, an address hosted in Germany under AS215311 Regxa Company for Information Technology Ltd. No TLS certificate is presented, indicating the site operates without HTTPS protection. The publicly visible page title, "Best Crypto Screening for Web3 | Trust," repeats the word “Trust” but does not reference the Trust Wallet brand directly; however, threat intelligence flags the domain as impersonating Trust Wallet and classifies the activity as a crypto‑scam. VirusTotal scans report that 14 of 93 security vendors label the domain as malicious, and the domain appears on three external security blocklists. Additional defensive feeds from PhishDestroy, MetaMask, and SEAL have already blocked the host, reinforcing the consensus that the site is hostile.

The Gridinsoft trust score of 0 / 100 provides a further quantitative indicator of the domain’s malicious reputation. Nameserver records list four managed DNS entries (795.dns1.managedns.org through 795.dns4.ma), a configuration commonly observed in disposable or rapidly redeployed phishing infrastructure. The current status of the domain is listed as offline, preventing real‑time verification of payloads or phishing pages. Consequently, the exact content served, any credential‑harvesting forms, or malicious scripts remain unconfirmed.

Nonetheless, the convergence of registrar data, IP location, lack of TLS, low trust score, multi‑vendor detection, and explicit brand‑impersonation labeling constitutes sufficient evidence for defensive action. Recommended mitigations include immediate network‑level blocking of trustaml.