trust-coinen[.]net

Analysis of trust-coinen.net indicates the domain was registered on 06 March 2026 via Gname.com Pte. Ltd. and immediately pointed to the Cloudflare‑owned address 188.114.96.3, which belongs to ASN 13335 in the United States. The associated TLS certificate is a Let’s Encrypt issuance (CN=E8), suggesting a short‑lived certificate typical of transient malicious infrastructure. The domain resolves to the same IP and uses Cloudflare’s authoritative name servers jill.ns.cloudflare.com and vick.ns.cloudflare.com. As of the report date the site is offline, which limits direct observation of the hosted content, but the page title reported by passive monitors is simply “trust-coinen.net/”, offering no legitimate branding or functional description.

Threat intelligence sources place trust‑coinen.net on three public blocklists and it is currently flagged by the PhishDestroy, MetaMask, and SEAL blocklist providers. VirusTotal scanned the domain and two of ninety‑four security vendors returned positive detections, reinforcing the suspicion of malicious intent. The combination of a recent registration, Cloudflare‑hosted IP, a generic page title, and multiple independent blocklist entries aligns with the classification of a generic phishing operation. Uncertainty remains regarding the specific payload or credential‑stealing mechanisms because the site is not reachable for content analysis.

Defenders should proactively deny any network traffic to 188.114.96.3 associated with this domain, add the domain to local blocklists, and monitor for any future re‑activation. Continuous observation of the registrar Gname.com and the Cloudflare name servers may reveal reuse of the same infrastructure for other malicious campaigns. In environments where users may interact with cryptocurrency wallets, particular attention to the MetaMask blocklist entry is advised, as it suggests attempts to target wallet‑related credentials.