trustwallet[.]com-two-factor-authentication12[.]vv[.]xtkuwd[.]com

The domain trustwallet.com-two-factor-authentication12.vv.xtkuwd.com was registered through IONOS SE on May 30, 2026 and is currently active. DNS resolution points to the IP address 77.68.5.178, and the authoritative nameservers are ns1.sslwhm.online and ns2.sslwhm.online, suggesting the use of a shared SSL‑enabled hosting environment. VirusTotal analysis shows that 15 of 91 security vendors flag the domain as malicious, providing moderate consensus that the site is involved in illicit activity.

It is listed on a single security blocklist, specifically blocked by PhishDestroy, yet the domain remains reachable. No additional public intelligence such as Safe Browsing verdicts, OTX mentions, SSL certificate details, HTTP response codes, or page title information is available at this time. The evidence points to a crypto‑drainer operation, likely aimed at extracting cryptocurrency assets from unsuspecting victims.

Defenders should incorporate the domain and its resolving IP into DNS filtering, proxy, and firewall rules, and consider adding the host to internal blocklists. Continuous monitoring of the IP and associated nameservers is advised to detect any infrastructure changes or new malicious payloads. Because the site’s content and exact attack flow have not been publicly disclosed, further investigation, including sandbox analysis of any retrieved pages, is recommended to fully characterize the threat vector.