rupesh[.]transactionshield[.]info

Analysis of rupesh.transactionshield.info indicates a high‑risk brand‑impersonation campaign targeting Trust Wallet. The domain was registered on May 22, 2026 and resolves to the Cloudflare‑hosted address 172.67.160.78, located in Canada. DNS is served by nora.ns.cloudflare.com and uriah.ns.cloudflare.com, and the site presents a TLS certificate issued by Google Trust Services under the WE1 identifier, confirming the use of HTTPS. HTTP requests return a 302 redirect, and the page title observed is "Transfer Trust Wallet," matching the declared brand target. Security tooling reports three detections out of ninety‑one VirusTotal scanners, and the domain appears on two public blocklists, including PhishDestroy and ScamSniffer. Infrastructure fingerprints reveal the presence of jsDelivr, Cloudflare, and HTTP/3, consistent with a lightweight delivery stack. The Gridinsoft trust score is 0 / 100, reinforcing the malicious assessment. Defenders should block the domain at the network perimeter, update DNS filtering policies to deny its IP range, and monitor for related indicators of compromise. Continuous observation is advised, as the site remains active and may evolve its delivery mechanisms.