trustnodes[.]app

trustnodes.app is flagged as a high‑risk brand‑impersonation domain targeting Trust Wallet. The site was registered on 24 February 2026 through Hosting Concepts B.V. operating under the Registrar.eu brand, and its authoritative nameservers are ina1.registrar.eu, ina2.registrar.eu and ina3.registrar.eu. DNS resolution returns a single IPv6 address 2a02:4780:2b:1868:0:1fed:d6c0:e, which belongs to AS47583 hosted by Hostinger International Limited and geolocated to the United States. No SSL/TLS certificate is presented, and the HTTP response code is 200, indicating that the server delivers content over an unencrypted channel.

The page title advertised by the site is “Trust Wallet – Best Crypto Wallet”, matching the targeted brand and confirming a crypto‑scam intent. VirusTotal analysis shows that 4 of 93 scanning engines have raised detections for this domain, and it is currently listed on one external blocklist and has been seized by the PhishDestroy takedown service. The domain appears in a single security blocklist, reinforcing its malicious classification. While the exact payload and login capture mechanisms have not been publicly disclosed, the combination of brand‑aligned title, lack of transport security, and multiple vendor detections strongly suggests a credential‑harvesting or fund‑exfiltration campaign aimed at Trust Wallet users.

Defenders should add the IPv6 address and the domain to network‑level deny lists, enforce TLS inspection for outbound connections to the host, and update endpoint protection signatures to include the observed indicator set. Monitoring of future DNS queries for ina*.registrar.eu and the AS47583 block should be instituted to detect any replication of this infrastructure. Incident response teams should treat any traffic or credential submissions to trustnodes.app as malicious and advise affected users to change their Trust Wallet credentials immediately.