trustwallet-airdrop[.]org

Analysis of trustwallet-airdrop.org indicates a credential harvesting operation that targets users of the TrustWallet application. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No SSL certificate is presented for the site, leaving the connection unencrypted and exposing visitors to potential man‑in‑the‑middle interception.

The hosting infrastructure advertises HSTS, Cloudflare Browser Insights, Cloudflare services, and HTTP/3, suggesting the attacker leveraged Cloudflare's free tier to obtain basic protection while obscuring the true origin server. The domain appears on three public security blocklists and has been flagged by the PhishDestroy, MetaMask, and SEAL blocklists, reinforcing the assessment that it is engaged in a crypto‑related scam. VirusTotal scans show that eight of ninety‑three antivirus engines flagged the domain as malicious, providing additional corroboration of its malicious intent.

The page title returned by the HTTP response is "Just a moment...", and no further content has been captured; the lack of a valid TLS certificate and the generic title prevent deeper content analysis at this time. Defenders should immediately block trustwallet-airdrop.org at network perimeter devices and endpoint security solutions, monitor outbound DNS queries for the domain, and consider adding the domain to internal threat‑intel feeds. Because the site is currently taken offline, continuous monitoring is advised to detect any re‑hosting attempts or related infrastructure changes that could signal a resurgence of the campaign.