trustwalletgfl[.]com

Analysis of trustwalletgfl.com indicates that the domain is currently offline but retains infrastructure consistent with a crypto‑related brand impersonation campaign. The domain was registered through Gname.com Pte. Ltd. on 21 February 2026 and resolves to the IP address 45.207.200.213, which is owned by AS8796 FASTNET DATA INC and geolocated in the United States. DNS resolution is served by a9.share-dns.com and b9.share-dns.net. The web server reports Nginx with HTTP/3 enabled and HSTS headers, and the TLS certificate is a Let’s Encrypt R13 certificate. The page title returned by the server is the Chinese phrase “网站筹建中”, translating to “Website under construction”. The domain is classified as a “Crypto Scam” and is flagged for brand impersonation of Trust Wallet.

Threat intelligence sources corroborate the malicious intent. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, indicating the highest risk. AlienVault OTX references the domain in one pulse, providing additional community confirmation. VirusTotal records 15 detections out of 93 scanning engines, demonstrating consensus among multiple anti‑malware products that the domain is malicious.

Despite the offline status, the presence of active DNS records, a live IP address, and a valid TLS certificate suggests that the infrastructure could be re‑activated quickly. Defenders should continue to block the domain at DNS and proxy layers, monitor for any future resolution changes, and add the IP address 45.207.200.213 to network‑level deny lists. Continuous correlation with threat feeds that reference this domain, especially those reporting crypto‑related impersonation, will help detect potential resurgence. Because the page content has not been publicly analyzed beyond the title, further investigation of any hosted payloads or redirects, should the site become reachable again, is recommended.