airdrop-trustwallet[.]trade

This domain, airdrop-trustwallet.trade, poses a high-risk brand impersonation threat targeting users of Trust Wallet, a cryptocurrency wallet service. Analysis indicates the domain mimics a legitimate token airdrop campaign, presenting a page titled 'TWT Token Airdrop: Complete Missions and Get Rewarded.' The fraudulent scheme is designed to deceive users into disclosing sensitive credentials, such as wallet recovery phrases or private keys, under the pretense of claiming rewards. Such tactics are commonly employed in cryptocurrency phishing operations to facilitate unauthorized access to digital assets. Evidence supporting the malicious nature of this domain includes detection by 11 out of 95 security vendors on VirusTotal, indicating a consensus among multiple threat intelligence sources. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with suspicious domains. Infrastructure analysis reveals the domain resolves to the IP address 104.21.50.204, hosted on Cloudflare’s network (AS13335), a common obfuscation technique to mask the true origin of malicious infrastructure. Additionally, the domain appears on three security blocklists and lacks an SSL certificate, further signaling its illegitimate nature. Users who visited airdrop-trustwallet.trade or interacted with its content should immediately revoke any permissions granted to unknown applications or browser extensions linked to the domain. It is critical to audit all connected wallet addresses for unauthorized transactions and transfer assets to a new, secure wallet if compromise is suspected. Enabling multi-factor authentication on all cryptocurrency-related accounts and monitoring for unusual activity is strongly advised. Victims should report the incident to relevant blockchain security teams and consider filing a report with local cybercrime authorities to aid in tracking the threat actors.