trustwallet[.]center

The domain trustwallet.center has been identified as a brand impersonation threat targeting TrustWallet, a cryptocurrency wallet service. This domain is currently classified as active and under investigation for fraudulent activity designed to deceive users into disclosing sensitive credentials or financial information. The threat type is specifically categorized as brand impersonation, leveraging TrustWallet’s branding to enhance credibility and exploit user trust. Infrastructure analysis reveals that trustwallet.center was registered on August 16, 2024, through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain resolves to the IP address 185.43.220.15, located in the Netherlands under AS59939 (WIBO Baltic UAB). As of the latest assessment, the domain has not been flagged by any of the 95 vendors on VirusTotal, indicating limited detection at this stage. However, it appears on one security blocklist, specifically PhishDestroy. The SSL certificate is issued by Let’s Encrypt (YR2), a common choice for both legitimate and malicious domains due to its accessibility and lack of cost. At present, trustwallet.center remains active and operational, posing an ongoing risk to users who may encounter it through phishing campaigns. Organizations and individuals are advised to block the domain and its associated IP address (185.43.220.15) at the network level. Security teams should monitor for any references to trustwallet.center in logs or user reports and conduct retrospective analysis to identify potential prior exposure. Users should be educated on recognizing brand impersonation tactics, particularly in the cryptocurrency sector, and encouraged to verify domain authenticity through official channels before interacting with any wallet-related services.