trustwallet-migrate[.]com

The domain trustwallet-migrate.com is flagged as a brand‑impersonation site targeting Trust Wallet users. VirusTotal records show that 7 of 93 security vendors have flagged the domain, indicating that multiple independent scanners have identified malicious characteristics. The domain resolves to the IP address 172.67.195.145, which belongs to Cloudflare’s network (AS13335) and is geolocated in the United States. Registration data reveals the domain was created on February 21, 2026 through GoDaddy.com, LLC, and the authoritative nameservers are brian.ns.cloudflare.com and naomi.ns.cloudflare.com, confirming Cloudflare hosting.

The site presents a Cloudflare‑generated page titled "Suspected phishing site | Cloudflare" and returns an HTTP 403 status code, suggesting that the content has been taken offline or blocked by the provider. SSL/TLS is supplied by Google Trust Services under the WE1 certificate, which is typical for Cloudflare‑protected sites and does not itself indicate malicious intent. The domain appears on six known security blocklists and is explicitly blocked by PhishDestroy, MetaMask, Polkadot, SEAL, and Enkrypt, reinforcing the assessment of a crypto‑related scam. Gridinsoft assigns a trust score of 0 out of 100, reflecting a lack of confidence in the domain’s legitimacy.

While the offline status limits direct analysis of the payload or user‑facing content, the convergence of vendor detections, blocklist presence, and brand‑targeted labeling provides sufficient evidence to classify the domain as a high‑confidence crypto impersonation threat. Defenders should add trustwallet-migrate.com to internal URL filtering and DNS blocklists, monitor for any resurgence of the domain or related subdomains, and enforce strict outbound controls to prevent accidental connections. Continuous observation of Cloudflare‑associated IP ranges for new domains with similar naming patterns is advised, as adversaries often reuse infrastructure.