trustwallet-turkiye[.]com

The domain trustwallet-turkiye.com was created on February 21, 2026 and is presently offline, but historical evidence indicates it was used for a crypto‑related brand impersonation campaign targeting Trust Wallet users. DNS resolution points to IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site was served behind Cloudflare’s network, employing HTTP/3 and presenting a TLS certificate issued by Google Trust Services under the WE1 label, confirming the use of a legitimate certificate authority but not the legitimacy of the content. The page title returned by the server was "Trust Wallet Türkiye - Resmi Destek," directly referencing the Trust Wallet brand and suggesting a Turkish support portal. Registration details show the domain was registered through NiceNIC International Group Co., Limited, a registrar that has been associated with other malicious registrations.

Security telemetry shows the domain appears on three blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, indicating consensus among threat‑intelligence feeds that the site was malicious. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the classification as high‑risk. VirusTotal analysis recorded four detections out of ninety‑three scanning engines, providing independent confirmation of malicious behavior. Nameserver configuration uses emely.ns.cloudflare.com and rene.ns.cloudflare.com, consistent with the Cloudflare hosting environment.

Defenders should treat any traffic to or from trustwallet-turkiye.com as hostile. Blocking the domain at the DNS or proxy layer will prevent accidental user navigation. Since the IP is shared across Cloudflare customers, broader IP‑based blocking may cause collateral impact; instead, enforce URL filtering for the exact domain and monitor for any sub‑domains that resolve to the same Cloudflare IP range.