trustw-aml[.]com

PhishDestroy identifies trustw-aml.com as a high-risk brand impersonation domain targeting Trust Wallet users with a fraudulent AML wallet application. This domain employs deceptive naming conventions to deceive victims into downloading malicious software or disclosing sensitive credentials under the guise of a legitimate cryptocurrency service. The threat actor leverages Trust Wallet's established reputation to lure victims, demonstrating a deliberate attempt to exploit user trust in well-known crypto platforms. This domain was flagged with a high risk level due to multiple indicators of malicious intent. Trustw-aml.com was created on April 27, 2026, and is registered through Unstoppable Domains Inc. The domain resolves to IP address 158.94.209.240 and has been detected by 4 out of 95 VirusTotal security vendors. Additionally, it has been blocked by MetaMask and SEAL security solutions and appears on two security blocklists. The domain operates with a Let's Encrypt SSL certificate, further enhancing its appearance of legitimacy, while the page title 'AML wallet App' explicitly misrepresents its true purpose as a malicious crypto drainer. To mitigate exposure to this threat, users should immediately cease interaction with trustw-aml.com and avoid downloading any applications or entering credentials associated with this domain. Verify the authenticity of any crypto-related website by cross-checking domain names against official Trust Wallet channels or using trusted security tools. Organizations should update their threat intelligence feeds to include this domain and consider implementing DNS filtering to block access. If any interaction has already occurred, users should revoke any exposed credentials, scan devices for malware, and report the incident to Trust Wallet's official support channels for further investigation and user protection.