trustwallet-uzx[.]com

Analysis of trustwallet-uzx.com confirms active credential-harvesting infrastructure impersonating Trust Wallet, a widely used cryptocurrency wallet service. The domain was registered on November 22, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk registrations. It resolves to the IP address 45.205.7.23, which has been linked to multiple phishing campaigns targeting financial and crypto-related brands. The site employs Nginx as its web server, supports HTTP/3 for performance, and enforces HSTS, a security header that may lend false legitimacy to unsuspecting users. The SSL certificate is issued by Let's Encrypt, a common choice among threat actors due to its free and automated issuance process. The domain is flagged by 20 out of 95 security vendors on VirusTotal, and appears on four independent security blocklists, including SEAL, MetaMask, PhishDestroy, and BLP-Malware. AlienVault OTX records the domain in 24 threat intelligence pulses, indicating widespread detection across the security community. The page title, rendered in Chinese as '网站搭建中' (meaning 'website under construction'), suggests an attempt to mask malicious intent or prepare for imminent deployment of phishing content. Despite this placeholder, the domain remains actively hosted and accessible, posing an ongoing risk. Infrastructure analysis reveals a high-risk hosting environment with no legitimate affiliation to Trust Wallet. The combination of recent registration, use of a high-risk registrar, and inclusion in multiple threat feeds strongly supports classification as a brand impersonation site designed to harvest credentials or distribute malicious payloads. Defenders should treat this domain as hostile and implement blocking at the DNS, network, and endpoint levels. Users encountering this domain should avoid interaction and report it to relevant security teams for further mitigation.