globalhrcap[.]com[.]trustwellcb[.]com

Analysis of the domain globalhrcap.com.trustwellcb.com indicates it was actively impersonating Trust Wallet, a cryptocurrency wallet service, as of its operational period. The domain, now offline, was registered on September 17, 2025, through Dynadot LLC and resolved to the IP address 192.3.190.188, hosted on AS36352 (HostPapa) in the United States. Infrastructure analysis reveals the domain used nameservers dns1.webproserver.com and dns2.webproserver.com, a common pattern in low-reputation hosting environments. No SSL certificate was present, a red flag for user security and legitimacy. The page title, 'Home - Global Hills Reliance Capital Bank,' does not align with the claimed Trust Wallet branding, suggesting either a generic template or an attempt to mislead users under a false financial institution guise.

The domain was flagged by 11 of 95 security vendors on VirusTotal and appeared on at least one security blocklist, with PhishDestroy marking it as malicious. Gridinsoft assigned a trust score of 0/100, further corroborating its high-risk classification. The scam type is classified as a crypto scam, consistent with the impersonation of Trust Wallet. While the domain is currently offline, its infrastructure remains a potential indicator of compromise.

Defenders should monitor for re-registration or reuse of the IP address, nameservers, or registrar. Historical DNS records and passive DNS data may provide additional context for tracking related campaigns. No evidence of a phishing kit or specific payload was provided, so the exact mechanics of the scam remain unconfirmed. Organizations are advised to block the domain and associated IP at perimeter security controls and alert users to the impersonation risk.