xn--trustwalle-b22e[.]com

This domain is flagged for elevated-risk brand impersonation targeting cryptocurrency wallet users. Analysis indicates the site mimics Trust Wallet interfaces to harvest credentials, seed phrases, or private keys from unsuspecting victims. The threat type is classified as brand_impersonation, a technique commonly used to exploit user trust in established digital asset platforms. Infrastructure analysis reveals the domain xn--trustwalle-b22e.com was registered on February 07, 2026, through Dynadot Inc. It resolves to IP address 172.67.180.7 and employs Cloudflare for traffic routing, alongside Node.js and Express for backend operations. The site uses a Let's Encrypt SSL certificate and supports HTTP/3, which may complicate detection due to encrypted traffic. Security vendors on VirusTotal flagged the domain at a 6/95 detection rate, while it appears on three distinct security blocklists. The page title, Tether.Wallet — The people’s wallet, further confirms the intent to mislead users by associating with both Trust Wallet and Tether, a popular stablecoin. Mitigation requires immediate blocking of the domain and its resolving IP across network security controls. Organizations should update endpoint protection rules to detect and prevent access to xn--trustwalle-b22e.com and related infrastructure. Users who may have interacted with the site should revoke any active sessions, rotate credentials, and verify wallet integrity for signs of unauthorized transactions. Security teams are advised to monitor for additional domains registered through the same registrar or resolving to the same IP range, as threat actors frequently reuse infrastructure for follow-up campaigns. Proactive hunting for similar brand impersonation patterns—particularly those targeting cryptocurrency services—is recommended to disrupt further exploitation attempts.