trustwallet-web-j6ad3[.]daftpage[.]com

Analysis of the domain trustwallet-web-j6ad3.daftpage.com indicates an active brand impersonation campaign targeting Trust Wallet users, classified as a high-risk crypto scam. The domain was registered on February 21, 2026, through OVH sas and currently resolves to the IP address 216.150.16.1, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The site employs a Let's Encrypt SSL certificate (R13) and returns an HTTP 308 status code, suggesting a redirect mechanism, though the final destination remains unconfirmed in this report. Detection data reveals that 15 of 95 security vendors on VirusTotal flag this domain as malicious, while PhishDestroy has explicitly blocked it.

The domain appears on at least one security blocklist, and Gridinsoft assigns it a trust score of 0/100, reinforcing its high-risk classification. Nameservers ns1.vercel-dns.com and ns2.vercel-dns.com indicate the use of Vercel's hosting platform, which is further supported by the detection of Next.js and React technologies. Additional tracking and engagement tools, including Google Analytics and Crisp Live Chat, are present, which are commonly leveraged in phishing campaigns to monitor victim interactions and enhance social engineering tactics. The page title, 'Trust Wallet | Your Trusted Mobile Crypto Wallet,' directly impersonates the legitimate Trust Wallet brand, aligning with the reported scam type of crypto fraud.

While the exact content and functionality of the site have not been analyzed, the combination of brand impersonation, hosting on a major cloud provider, and detection by multiple security vendors confirms its malicious intent. Defenders are advised to block the domain at the DNS or network level, monitor for related subdomains or IP associations, and alert users to avoid interaction with any communications or advertisements linking to this domain.