dexnut[.]top

Analysis of the domain dexnut.top on July 23, 2026, confirms its involvement in a Trust Wallet impersonation scam. This domain, registered through NiceNIC International Group Co., Limited, was created on September 30, 2025. Infrastructure analysis reveals that the domain is hosted in the United States under the ASN AS40680 Protocol Labs, with nameservers coen.ns.cloudflare.com and tia.ns.cloudflare.com. The domain currently resolves to the IP address 209.94.90.1 and is taken offline.

Despite its offline status, the domain has been flagged by 4 out of 95 security vendors on VirusTotal, indicating prior malicious activity. The domain appears on one security blocklist and has been blocked by PhishDestroy, further corroborating its malicious intent. The Gridinsoft trust score for this domain is 0 out of 100, the lowest possible score, suggesting a high level of risk.

The page title 'REWARD Portal v2 -- Latest Web3 Wallets' suggests that the site was designed to deceive users into believing they were accessing a legitimate Trust Wallet service. Defenders should ensure that this domain is blocked in all network and endpoint security controls to prevent any potential reactivation or use by malicious actors. Additionally, users should be educated about the risks of visiting untrusted or impersonated websites, especially those purporting to offer cryptocurrency services, and should verify the authenticity of any Trust Wallet-related links before engaging with them.