trustwallets[.]guru

Analysis of the domain trustwallets.guru indicates active brand impersonation targeting TrustWallet, a cryptocurrency wallet service. The domain was registered on July 3, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and remains operational as of July 12, 2026. Infrastructure analysis reveals the domain resolves to IP address 104.21.95.5 and employs Cloudflare with HTTP/3 support, a common configuration for phishing sites seeking to evade detection and enhance performance. The SSL certificate is issued by Google Trust Services, providing a superficial appearance of legitimacy. The page title, 'Welcome!', is generic and does not inherently confirm malicious intent, though it aligns with common phishing page behavior. The domain is flagged on one security blocklist (PhishDestroy) and appears in four AlienVault OTX threat intelligence pulses, indicating prior identification by security researchers. Five of 95 security vendors on VirusTotal have flagged the domain, though the specific nature of these detections remains unverified. No evidence of a phishing kit or additional technical artifacts has been confirmed at this stage. Defenders should treat this domain as high-risk infrastructure, particularly given its recent registration and association with TrustWallet impersonation. Network-level blocking of 104.21.95.5 and monitoring for related domains registered through the same registrar are recommended. Further investigation into the site's content and backend infrastructure is necessary to determine the full scope of the threat.