trx-demo[.]top

This domain, trx-demo.top, is actively flagged as a high-risk brand impersonation resource targeting Trust Wallet users. Analysis indicates the domain was registered on May 11, 2025, through a registrar commonly observed in fraudulent infrastructure deployments. The site resolves to the IP address 188.114.97.3, which is associated with content delivery networks frequently exploited to mask malicious activity. Security vendors have identified this domain in 14 out of 95 detection engines, and it appears on at least two established blocklists, reinforcing its classification as a confirmed threat. Infrastructure analysis reveals the use of Cloudflare and HTTP/3, technologies often leveraged to enhance performance and evade detection. The SSL certificate is issued by Google Trust Services, a legitimate provider, which does not mitigate the domain’s fraudulent intent but may contribute to user deception by presenting a seemingly secure connection. The page title, 'Trustwallet scan,' explicitly aligns with the known impersonation of Trust Wallet, a cryptocurrency wallet service, suggesting the site is designed to deceive users into interacting with fraudulent scanning or verification mechanisms. The domain remains active as of July 12, 2026, and has been referenced in 24 threat intelligence pulses, indicating ongoing monitoring by security researchers. While the exact content and functionality of the site have not been fully analysed, the combination of brand impersonation, security vendor detections, and blocklist inclusions provides sufficient evidence to classify this domain as a high-risk resource. Defenders should treat this domain as malicious and prioritise blocking or monitoring any interactions originating from or directed toward it. Network-level mitigations, such as DNS filtering or IP-based restrictions, are recommended to prevent potential compromise of end-users.