m[.]trustwalletlnv[.]com

The domain m.trustwalletlnv.com was observed hosting a brand‑impersonation campaign targeting Trust Wallet. Registration data shows the domain was created on 2 May 2026 through the registrar Gname.com Pte. Ltd. The authoritative name servers are a5.share-dns.com and b5.share-dns.net, and DNS resolution points to the IPv4 address 47.80.68.7. Geolocation of the address places it in the Philippines and attributes the host to Delta Centric LLC operating under Zenlayer Inc. An HTTPS endpoint is served with a Let’s Encrypt certificate and the web server identifies itself as Nginx supporting HSTS and HTTP/3. The HTTP response code returned during probing was 200, indicating the site was reachable before being taken offline.

VirusTotal analysis recorded 14 detections out of 91 scanned security vendors, confirming that multiple engines classify the host as malicious. Independent phishing‑filtering services such as PhishDestroy, MetaMask, and SEAL have added the domain to their blocklists, and it appears on three additional security blocklists. The observed evidence does not include a page title or the full HTML content, so the exact visual presentation of the impersonation page remains unknown.

However, the combination of brand targeting, the use of a legitimate‑looking TLS certificate, and the presence on multiple blocklists strongly suggests a coordinated attempt to harvest credentials or otherwise deceive Trust Wallet users. Defenders should block the domain at DNS and proxy layers, monitor outbound connections to the associated IP address, and add the host to internal threat‑intelligence feeds. Continued observation of any re‑registration attempts or changes to the hosting infrastructure is recommended to detect possible resurgence.