trust-wallet[.]claims

The domain trust-wallet.claims was observed delivering a wallet‑seed phishing campaign that masquerades as a TrustWallet airdrop. The site presented the page title “TWT Token Airdrop: Complete Missions and Get Rewarded” and employed the publicly available Airdrop Scam phishing kit. Technical analysis shows the domain resolves to the IPv4 address 213.165.61.42, which is allocated to AS207713 (GLOBAL INTERNET SOLUTIONS LLC) in Russia. The authoritative nameservers are a.dnspod.com, b.dnspod.com, and c.dnspod.com, and the registration was performed through the GIR_SER‑NET registrar, linking the infrastructure to ASN 207713.

No TLS certificate is presented; the site served only HTTP, reducing the possibility of encrypted traffic inspection. VirusTotal listed the domain in 12 of 95 security vendor checks, and five independent blocklists have already added the host. Additional defensive feeds—including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura—have flagged the domain as malicious. The service has been taken offline at the time of reporting, and no further HTTP response was captured, limiting visibility into the exact payload delivered beyond the page title.

The evidence confirms a targeted impersonation of the TrustWallet brand, specifically aiming to harvest cryptocurrency wallet seeds under the guise of an airdrop. Defenders should add the domain and its resolved IP address to network‑level denial lists, monitor DNS queries for the associated dnspod.com nameservers, and ensure endpoint protection retains the 12 vendor detections for future correlation. Continuous observation of ASN 207713 activity is advised, as related infrastructure may be reused in subsequent campaigns.