trustowallet[.]cc

The domain trustowallet.cc was registered on 21 February 2026 through Chengdu West Dimension Digital Technology Co., Ltd. and resolves to the IPv4 address 103.140.127.114, which is announced by AS55933 Cloudie Limited and geolocated to Hong Kong. The authoritative name servers are mckenzie.ns.cloudflare.com and zac.ns.cloudflare.com, indicating that the domain is using Cloudflare’s DNS infrastructure. No TLS certificate is presented for the site, meaning all HTTP traffic is delivered over cleartext connections.

When accessed, the HTTP response returns a page titled “SoftEther VPN Server”. This title is commonly associated with legitimate VPN gateway software, and its presence on the site suggests an attempt to masquerade as a trusted remote‑access portal. Crypto‑drainer campaigns frequently exploit such VPN‑like interfaces to request private keys, seed phrases, or wallet passwords under the pretense of configuring a secure connection. The absence of HTTPS further reduces friction for credential capture, as browsers will not warn users about insecure transport.

The domain appears on three independent security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal has flagged the domain in 14 of 95 scans, reinforcing the suspicion that the site hosts malicious content. The combination of recent registration, low‑reputation hosting, and alignment with known cryptocurrency draining tactics increases the confidence that trustowallet.cc is being used to harvest wallet credentials.

Defenders should add trustowallet.cc to network‑level deny lists and enforce DNS sink‑hole rules for the associated IP address 103.140.127.114. Traffic inspection policies ought to block clear‑text HTTP to this host and flag any outbound connections that include cryptocurrency‑related keywords. Incident response teams should monitor for any compromised credentials that match the pattern of seed phrases or private keys submitted to the site, and consider notifying affected users to rotate their wallets. Continuous monitoring of the Cloudflare name servers for new subdomains is advised, as threat actors often expand the infrastructure under the same resolver.