usdwin[.]la

The domain usdwin.la was registered on October 28, 2025 through Dynadot LLC and is presently active. It is classified as a high‑risk brand‑impersonation campaign targeting the Trust Wallet brand, with the specific scam type identified as wallet_connect_phish. The site presents the page title "REWARD Portal v2 | Latest Web3 Wallets," indicating an attempt to lure users interested in Web3 wallet rewards.

Infrastructure analysis shows that usdwin.la resolves to IP address 209.94.90.1, which belongs to AS40680 (Protocol Labs) and is geolocated in the United States. The domain uses Cloudflare nameservers (dane.ns.cloudflare.com, isabel.ns.cloudflare.com) and serves its content over HTTPS with a certificate issued by Google Trust Services under the WE1 designation. The presence of IPFS and HTTP/3 protocols suggests the site may be leveraging decentralized storage and modern transport mechanisms.

Threat intelligence sources report that usdwin.la appears on a single security blocklist and has been flagged by PhishDestroy. The Gridinsoft trust score is 1 out of 100, reflecting extreme suspicion. VirusTotal scans return six positive detections out of ninety‑five vendors, reinforcing the malicious assessment. An HTTP request to the domain returns status code 403, which may indicate deliberate access restrictions or evasion tactics.

While the available data confirms the domain’s malicious intent, the exact content served to end users remains unverified, as no visual analysis of the page has been performed. Defenders should block DNS resolution for usdwin.la, enforce strict outbound filtering to the associated IP, and monitor for any WalletConnect traffic that may be redirected to this host. Continuous vigilance is advised, including periodic re‑scanning of the domain and updates to internal blocklists, to mitigate potential credential harvesting against Trust Wallet users.