trustwallet-pay[.]world

This domain is flagged as an active high-risk brand impersonation threat targeting Trust Wallet users. Analysis indicates the infrastructure is designed to deceive victims into disclosing cryptocurrency wallet credentials or installing malicious software under the guise of a legitimate service. The page title 'NewsTrustApp' suggests an attempt to mimic official Trust Wallet communications, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals the domain trustwallet-pay.world was registered on June 15, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It currently resolves to IP address 188.114.96.3 and presents an SSL certificate issued by Google Trust Services (WE1). Detection metrics show 3 out of 95 security vendors on VirusTotal have flagged the domain, while it appears on three distinct security blocklists. The domain remains operational despite being blocked by multiple threat intelligence feeds. Mitigation requires immediate action from network defenders and end users. Organizations should update web filtering rules to block both the domain and its resolving IP address (188.114.96.3) at the perimeter. End users must verify all communications claiming to be from Trust Wallet by cross-referencing official channels, particularly those requesting credential input or software installation. Given the domain's recent registration and active status, continuous monitoring for related infrastructure (e.g., subdomains, newly registered lookalike domains) is recommended to prevent further exploitation.