MALICIOUS — CRITICAL
trustwallet-connection[.]com
4 of 95 security engines flagged the domain; 5 public blocklists listed it (MetaMask, Polkadot, SEAL); the latest stored check returned HTTP 451.
- VirusTotal
- 4/95
- Blocklists
- 5 · MetaMask, Polkadot
- sẵn có
- Nội dung không có sẵn · HTTP 451
Do not enter credentials, seed phrases, payment details, or personal information on this domain.
Jump to section
trustwallet-connection.com — Nội dung không có sẵn (HTTP 451). Mạo danh thương hiệu: Trust Wallet; Loại lừa đảo: Crypto Scam. Tóm tắt bằng chứng: VirusTotal 4/95 (Bfore.Ai PreCrime, Ermes, Fortinet, Gridinsoft); Spamhaus DBL_PHISH; 5 external blocklist matches; PhishDestroy score 90/100. Nhà đăng ký: Tucows.
Phân tích chi tiết của PhishDestroy AI bên dưới được giữ bằng tiếng Anh để bảo toàn hồ sơ pháp chứng gốc.
Evidence Digest
trustwallet-connection.com is classified critical with an evidence score of 90/100. 4 of 95 security engines flagged the domain; 5 public blocklists listed it (MetaMask, Polkadot, SEAL). Registered 10 Aug 2025 via Tucows Domains Inc., hosted on 64.29.17.65 (AMAZON-02, US, US). The latest stored check on 9 Aug 2026 returned HTTP 451 and includes a capture.
Stored generated summary (templated)mistral · 24/07/2026
Retained for the record. This text repeats stored detection facts and is not presented as authored analysis.
Analysis of the domain trustwallet-connection.com indicates a confirmed brand impersonation targeting TrustWallet, a cryptocurrency wallet service. The domain was registered on August 10, 2025, through Tucows Domains Inc. and is currently offline, returning an HTTP 451 status code. Infrastructure analysis reveals hosting on Amazon.com, Inc. (AS16509) in the United States, resolving to the IP address 64.29.17.65. The domain employs Vercel nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com) and utilizes a Let's Encrypt SSL certificate (R13), with HSTS enabled. The page title, 'Trust Wallet - Connection,' directly aligns with the impersonated brand, reinforcing the classification as a crypto scam.
Security vendors have flagged this domain, with 4 out of 95 engines on VirusTotal detecting malicious activity. It appears on six security blocklists, including PhishDestroy, MetaMask, Polkadot, SEAL, and Enkrypt, which have proactively blocked access. The domain's creation date, combined with its rapid detection and subsequent takedown, suggests a short-lived but high-risk operation. While the exact content of the site remains unanalyzed, the combination of infrastructure, hosting provider, and blocklist presence provides concrete evidence of fraudulent intent.
Defenders should treat this domain as a confirmed threat, particularly in environments where TrustWallet or cryptocurrency-related services are used. Monitoring for related domains with similar naming patterns (e.g., 'trustwallet-[modifier].com') is recommended, as threat actors often reuse infrastructure or naming conventions. Given the domain's current offline status, further forensic analysis may be limited, but historical DNS and WHOIS records should be preserved for potential investigations. Organizations should ensure endpoint protection and browser-based security tools are updated to block this domain and any associated indicators of compromise.
Phạm vi dữ liệu12 recorded checks
Pipeline ứng phó với các mối đe dọa
Trạng thái trong danh sách chặn công khai
Bản chụp đã lưu
Thông tin về tên miền
Chi tiết kỹ thuậtDNS, SAN trong SSL, dấu thời gian
ICANN OVERSIGHT
Bối cảnh công nhận và RAA
Bối cảnh công nhận và RAA
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Công nghệ · 2 identified
Cloud platform for frontend deployment, optimized for Next.js.
HTTP Strict Transport Security — forces browsers to use HTTPS connections only.
Phân tích của VirusTotal
Bằng chứng lưu trữ
Bằng chứng và các báo cáo bên ngoàiIndependent lookups and source reports
Victim safety and official reportingImmediate actions and verified reporting channels
Nếu bạn đã nhập thông tin xác thực tài khoản, thông tin cá nhân hoặc thông tin thanh toán hoặc đã tải xuống tệp từ miền này, hãy hành động ngay lập tức. Dưới đây là các nguồn lực giúp bạn báo cáo vụ việc và bảo vệ chính mình.
Hãy báo cáo với chính quyền địa phương
Chọn quốc gia của bạn để nhận liên hệ tội phạm mạng chính thức hoặc soạn thảo đơn khiếu nại →.