trustwallet-debit-e80df122-10951[.]omnicoder[.]app

Analysis of trustwallet-debit-e80df122-10951.omnicoder.app confirms an active brand-impersonation campaign targeting Trust Wallet users. The domain was registered through CloudFlare, Inc. and currently resolves to 188.114.97.3, a Canadian-hosted IP assigned to CloudFlare. Nameservers damien.ns.cloudflare.com and jessica.ns.cloudflare.com further link the infrastructure to CloudFlare. The SSL certificate is issued by Google Trust Services (WE1), a common choice for phishing sites leveraging CloudFlare’s proxy services. The page title 'Just a moment...' suggests a CloudFlare security challenge or holding page, which may indicate the site is either newly deployed, awaiting activation, or configured to filter traffic. The HTTP 403 status confirms the server is reachable but currently blocking public access, a tactic sometimes used to evade automated crawlers while maintaining operational readiness. No specific scam mechanism (e.g., crypto drainer, fake login, or token theft) is confirmed in the available data, though the domain name structure implies an intent to deceive users into believing it is an official Trust Wallet debit or transaction service. Three security vendors—PhishDestroy, MetaMask, and SEAL—have blocked the domain, and it appears on three public blocklists. Seven of 91 VirusTotal security vendors flag the domain as malicious. Defenders should treat this domain as high-risk and prioritize blocking at DNS, proxy, and endpoint levels. Given the CloudFlare proxy, IP-based blocking may be ineffective; domain-based controls are recommended. If the site becomes fully active, users may be prompted to enter wallet credentials or seed phrases, leading to direct asset theft. No evidence suggests compromise of Trust Wallet’s official infrastructure.