trustwallet[.]now

trustwallet.now is an active domain observed on July 12, 2026 that is being used for a high‑risk brand‑impersonation campaign targeting Trust Wallet users. The site resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. DNS resolution is provided by the Cloudflare nameservers gabriella.ns.cloudflare.com and guss.ns.cloudflare.com, indicating that the infrastructure is fully hosted behind Cloudflare’s edge network. The service presents an HTTP/3 endpoint protected by a TLS certificate issued by Google Trust Services under the WE1 root, yet the HTTP response code returned is 521, suggesting that the origin server is refusing connections, a pattern often observed in malicious fast‑flux setups. The page title returned by the server is “Success!”, and the campaign has been classified as a crypto‑scam. VirusTotal analysis shows that 5 of 95 security vendors flagged the domain, and it appears on a single external blocklist. Gridinsoft assigns a trust score of 0 out of 100, and the domain is already listed by PhishDestroy as blocked. The overall risk rating is high, and the campaign remains active. Evidence confirms the impersonation of the Trust Wallet brand, but the exact content served to victims has not been publicly disclosed. Defenders should block DNS resolution to 188.114.97.3, enforce outbound filtering for HTTP/3 traffic to the domain, and add the domain to internal phishing and malware blocklists. Continuous monitoring of Cloudflare‑hosted infrastructure for similar patterns is recommended, as the attacker may leverage the same provider for additional malicious domains.