amltrustwallet[.]info

Analysis confirms that amltrustwallet.info was registered on March 22 2026 through Global Domain Group LLC. The domain is delegated to the Cloudflare nameservers santino.ns.cloudflare.com and wren.ns.cloudflare.com, indicating use of Cloudflare’s DNS and proxy services. The site resolves to IP address 188.114.97.3, which is assigned to a Cloudflare infrastructure located in Canada. The web server presents an HTTP 521 status, a Cloudflare‑specific error that signals origin server unavailability. TLS is provided by a Let's Encrypt certificate (issuer E7), and the page title returned by the server is “AML Trust Lab | Secure Computation Network for Blockchain-adapted Cryptography”. Fingerprinting shows Vue.js, SweetAlert2, LiveChat, Facebook Pixel, Cloudflare Browser Insights, and HTTP/3 support, confirming a modern JavaScript‑heavy stack. The domain is classified as a high‑risk brand‑impersonation campaign targeting the Trust Wallet brand. The page title and the explicit “Trust Wallet” reference in the intelligence indicate an attempt to lure cryptocurrency users. Independent scanning on VirusTotal recorded 16 detections out of 95 scanners, and the Gridinsoft trust score is 0 out of 100. The domain appears on three public security blocklists and is already blocked by multiple anti‑phishing feeds. These concrete indicators collectively support the high‑risk rating. While the exact landing‑page content has not been captured, the available metadata is sufficient for defensive actions. Security teams should enforce DNS‑level blocking for amltrustwallet.info, update endpoint protection signatures to include the observed IP 188.114.97.3, and monitor for any traffic that attempts TLS connections to the domain. Continuous re‑analysis is advised in case the origin server becomes reachable, which could reveal additional malicious payloads.