wallauth-trump[.]cfd

The domain wallauth-trump.cfd was created on February 21, 2026 and is presently taken offline. It is listed on a single security blocklist and has been blocked by the PhishDestroy service. DNS resolution points to IP address 94.154.35.90, an address registered to Omegatech LTD in the Netherlands under ASN 202412. The domain is registered through Web Commerce Communications Limited and uses four EternityNames nameservers (ns1.eternitynames.net, ns2.eternitynames.net, ns3.eternitynames.net, ns4.eternityna). No SSL certificate was observed, leaving the site unencrypted.

Gridinsoft assigned a trust score of 0 out of 100, indicating extremely low reputation. VirusTotal analysis shows six of ninety‑three security vendors flagging the domain, consistent with a malicious classification. The page title returned by the server is "TRUMP WALLET AIRDROP", and the campaign is identified as an Airdrop Scam employing a Crypto Scam kit. The site impersonates the Coinbase brand, targeting users with a fraudulent airdrop narrative.

While the domain is no longer active, the infrastructure—particularly the hosting IP and registrar—remains observable and could be reused in future campaigns. Defenders should add the IP 94.154.35.90 to threat intel feeds, monitor for any new domains registered with the same registrar or nameserver pattern, and enforce strict URL filtering for any URLs containing "wallauth-trump.cfd" or similar sub‑domains. Network sensors should be configured to block connections to the hosting ASN and to flag any HTTP requests lacking TLS for this host. Continued surveillance of the associated blocklist entry and the PhishDestroy feed will help capture re‑emergence of the campaign.