The firm has already handled this case: three addresses for the same activity, built by reshuffling the same two words across different extensions and all dark today. How to recognise name rotation and what to do if you cannot remember which site you paid into.
Preliminary note: we are a law firm and we deal exclusively with online fraud and the unauthorised provision of financial services. This article arises from a real case handled by the firm and is published in anonymised form as regards the injured party, for public interest purposes. The technical data come from checks on the public domain-name registries carried out on the date of publication. If you recognise yourself in what you read, you can submit your situation using the form at the bottom of this page.
The trust-defi.link file contains three different addresses. Two of them are made from the same two words, in reverse order. The third is the first one again, but with another extension.
It looks like a pedant's detail. It is in fact one of the most effective ways to recognise these structures before paying, and one of the reasons why so many people, when they come to us, cannot say for certain which site they put their money into.
trust-defi.link is a scam, the firm has already handled this case, and here we explain how name rotation works, why it is no accident that the names are almost identical, and what to do when more than one address is involved.
Why trust-defi.link is a scam: the checks
The simplest fact is also the sharpest: trust-defi.link is no longer registered today. It has left the registries, and with it the details of whoever held it.
The same goes for the other two addresses used in the same affair, one with a .site extension and one with a .co extension: none of the three is still registered.
Three names, three extensions, no company. Behind trust-defi.link there never was a VAT number, a company name, an authorisation to provide investment services, or a verifiable reference to an intermediary on any supervisory register.
The chosen extensions are worth noting. .link, .site and .co are among the cheapest and quickest generic extensions to obtain: they require no qualification, no verification, no local presence. Using them is not unlawful — a great many legitimate projects do — but when a party asking for money chooses three extensions of this kind instead of a stable corporate domain, that is information.
Name rotation: why they are almost identical
Here is the trust-defi.link point worth taking away, because it helps you recognise the next signboard before it does any damage.
An organisation collecting money online has a practical problem: domains get reported, end up on operators' lists, are suspended by registrars, are blocked by supervisory authorities. A signboard's useful life is short.
The solution adopted by trust-defi.link too is always the same: keep the brand and change the wrapper. The three most common variants are these.
Reversing the words, as between trust-defi.link and its twin: the name stays recognisable to those already inside — "it is still our platform, we have only changed address" — but to an automatic filter it is a new string.
Changing the extension while keeping the name, as in the third address in the same affair: it costs a few euros and takes five minutes.
Adding prefixes and suffixes — "eu-", "-group", "-official", "app.", "my." — which change nothing of substance but create a different address.
The result, for the injured party, is a very concrete experience: at a certain point they are told that "the site is under maintenance" or that "we are migrating to the new platform", and they are given a new address where they find their balance, identical.
That moment is the clearest signal of all. A serious intermediary does not move you to a new domain over chat. We have documented the same pattern writing about bgdd66.it and dsfs36.it.
What the similarity of names proves, and what it does not
Here trust-defi.link calls for the rigour we always apply, because that is what makes an investigative hypothesis solid rather than merely suggestive.
Similarity between two domain names, on its own, does not prove that the same party is behind them. Anyone can register a name similar to another, and the history of the internet is full of imitators with nothing to do with the original.
In the trust-defi.link case, however, nothing rests on similarity. It rests on a lived and documented fact: it was the same organisation, in the same conversation, that gave the injured party the three addresses, one after the other, in order to continue the very same operation. That is not a technical inference: it is a matter of fact, which the exported conversation demonstrates.
That is why, in cases like this, the chat documentation is worth more than any analysis of the names: it does not need interpreting.
"I do not remember which site I paid into"
It is a sentence we hear often from people who have been through trust-defi.link, and many say it with embarrassment, as though it were a failing of their own.
It is not. If there were three sites, it is normal not to remember which was active in which week. The confusion is not a defect in the victim's memory: it is a product of the method.
The practical answer is simple and must be put in writing in the complaint: all the addresses are listed, each with the period in which it appears to have been used, stating that this is the same activity continued on different domains. You do not have to choose: it is not necessary to know which is "the right one", because they are all part of the same affair.
The elements that allow the stages to be dated are almost always there: the dates of the messages in the exported conversation, the dates of the transactions in the exchange history or in the bank advices, the creation dates of the screenshots.
The problem of time, and why it matters more here
When the domains are dark, as in the trust-defi.link case, part of the information has already gone.
For trust-defi.link the public registries show the current position, not the history: for a domain no longer registered, neither the registrant's details nor the technical configurations of the time can be obtained. Connection addresses and access logs have even shorter lives.
What remains, however, is everything the injured party kept, and everything that passed through parties obliged to retain it: banks, payment institutions and exchanges, required to keep transaction data for ten years under anti-money-laundering rules.
That is why, in affairs with several domains, the priority is not to chase the sites: it is to secure the documentation of the money and of the conversations, which does not expire at the same rate.
The legal framework
The facts relating to trust-defi.link date from 2023, and are therefore prior to Law 90/2024: the aggravating circumstance of Article 640(2-ter) does not apply. The circumstances in force at the time must be pleaded: diminished capacity to defend oneself (Article 61(5)) and particularly serious financial loss (Article 61(7)).
The repeated payments on trust-defi.link and the other domains form a single criminal design and therefore a continuing offence (Article 81(2)): that is a point to make explicitly in the complaint, because a plurality of signboards must not be read as a plurality of unconnected affairs.
Offering investment services to the public without authorisation falls under Article 166 of the Italian Consolidated Law on Finance, prosecuted ex officio. The subsequent movement and conversion of the sums are relevant as money laundering (Article 648-bis) and, for whoever reinvests, as self-laundering (Article 648-ter.1), with longer limitation periods than fraud and running from the acts of reinvestment.
What to do now
Anyone who has dealt with trust-defi.link, or with a platform that changed its address mid-course, should do the following.
Write out the complete list of addresses used, with the period of use of each, before the memory becomes further confused.
Export the conversations with the application's native function, with dates and times: it is the document that links the three names to the same activity.
Recover the documentation of the money: bank advices with IBAN and holder, or exchange history and transaction hashes if the payments were in cryptocurrency.
Recover every screenshot of the platform, from any of the three addresses, with the date it was taken.
File or supplement the complaint, listing all the domains and asking for preventive seizure (Article 321 of the Code of Criminal Procedure), information on registration under Article 335 and notice in the event of a request to shelve the case under Article 408(2).
Similar cases already handled by the firm
Anyone who has come across trust-defi.link will also find useful our analysis of defi-trust.site, on the same affair from the point of view of cryptocurrency moved by the victim, and that of sd3257.it, on what a technical link between domains really proves.
If they moved you to a new address: stop there
The picture is this. trust-defi.link is a scam: one of the three names used by the same activity, all three no longer registered today, built by reshuffling the same two words across different extensions, behind which there never was a company.
The rule to take away is this: when the platform holding your money asks you to move to a new address, that is the moment to stop, not to follow the link. And if it has already happened, all the domains belong in the complaint, because they are the same affair.
The firm has already handled this case. You can submit your situation for a preliminary assessment.
If you have suffered the same scam, we can help you. Fill in the form at the bottom of this page.
Do you need legal assistance?
Tell us about your case: free assessment, no obligation.
