trustoptima[.]com

trustoptima.com entered the PhishDestroy evidence set on Apr 28, 2026. Stored content metadata identifies ["across"] as the apparent target. Content analysis also recorded brand signals for Across. The stored content classification is crypto drainer. The assembled evidence scores 87/100 (high).

Three independent sources are positive: VirusTotal, Spamhaus DBL, and URLQuery. VirusTotal recorded 11 detections among 91 engines: alphaMountain.ai, BitDefender, CRDF, ESET, Fortinet, G-Data, Gridinsoft, Hunt.io Intelligence, Netcraft, SOCRadar, VIPRE on Jul 28, 2026 at 02:27 UTC. Spamhaus DBL: DBL_SPAM on Jul 13, 2026 at 18:31 UTC. URLQuery recorded 2 detections. The evidence is not unanimous. The external blocklist snapshot contained no matches on Aug 7, 2026 at 14:20 UTC. On Apr 28, 2026 at 19:36 UTC, Google Safe Browsing returned no flag; PhishStats returned no feed match. URLScan completed without a malicious verdict (score 0) on Jul 31, 2026 at 08:18 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 02:14 UTC; content was unavailable. Registration records for the domain list TuringSign Inc. d/b/a Cosmotown as the registrar and Apr 28, 2026 as the creation date. Registration preceded first observation by 0 days. At collection time, the hostname resolved to 37.49.229.75 on AS3920 (PUSHPKT OU). The associated network metadata labels the endpoint as ESTOXY OU in Amsterdam, NL. The stored server header is LiteSpeed. Captured page title: “Trustoptima Bank”. DOM analysis completed on Jul 29, 2026 at 06:20 UTC; stored DOM score 56/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Jul 29, 2026 at 02:04 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Jul 27, 2026; checked Apr 28, 2026 at 23:00 UTC.

Taken together, the page content and independent findings support classifying this hostname as ["across"]-themed crypto drainer.