trustwalletus[.]at

Analysis of trustwalletus.at indicates a high-risk phishing domain targeting users of the Trust Wallet cryptocurrency service. The domain was registered on February 21, 2026, and resolves to the IP address 45.137.152.136, hosted under AS214822 (MT FINANCE LLC) in Russia. No SSL certificate was detected, and the server technology identified is Nginx. The page title, 'Download Trust Wallet | Download Extension | Mobile App & Desktop Extension,' explicitly impersonates Trust Wallet, a known cryptocurrency wallet provider, aligning with the reported scam type of a crypto scam.

Security vendor detections are significant, with 17 of 93 vendors on VirusTotal flagging the domain as malicious. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Nameservers are configured to a.dnspod.com, b.dnspod.com, and c.dnspod.com, a pattern commonly observed in phishing infrastructure. At the time of this report, the domain has been taken offline, though defenders should remain cautious of potential reactivation or migration to similar domains.

Defenders are advised to treat this domain as confirmed malicious. Network-level blocking of the IP 45.137.152.136 and associated nameservers is recommended to prevent access. Monitoring for newly registered domains with similar naming patterns or infrastructure (e.g., DNSPod nameservers, Russian hosting providers) may help preempt related threats. Given the absence of an SSL certificate and the domain's offline status, further forensic analysis of the site's content is not currently possible, but the available evidence strongly supports its classification as a crypto wallet phishing operation.