extension[.]egjidjbpglichdcondbcbdnbeeppgdph[.]com

This domain is flagged for elevated-risk brand impersonation targeting Trust Wallet, a cryptocurrency wallet service. Analysis indicates the infrastructure is designed to deceive users into disclosing sensitive credentials or authorizing fraudulent transactions, potentially leading to unauthorized access and crypto asset theft. The domain exhibits multiple technical indicators aligning with malicious activity, including the absence of legitimate brand affiliation and deliberate obfuscation tactics. Infrastructure analysis reveals the domain was registered on December 20, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 178.16.54.185, hosted under AS202412 (Omegatech LTD) in the Netherlands, a network segment with a history of hosting phishing and scam operations. The domain lacks an SSL certificate, further reducing its perceived legitimacy. Detection metrics indicate 25 out of 95 security vendors on VirusTotal have flagged the domain as malicious, and it appears on at least one security blocklist. The page title explicitly mimics Trust Wallet, reinforcing the intent to impersonate the legitimate service. Mitigation against this threat type requires multi-layered defenses. Users should verify domain authenticity by cross-referencing official Trust Wallet communication channels and avoiding interaction with unsolicited links. Organizations should implement DNS-based blocking for the domain and its associated IP, monitor for similar registration patterns (e.g., newly created domains with cryptocurrency-related keywords), and deploy endpoint protection capable of detecting brand impersonation attempts. Given the domain’s current offline status, continuous monitoring for reactivation or rebranding under new domains is recommended. Security teams should prioritize user education on recognizing crypto-related phishing, particularly the risks of interacting with unverified wallet interfaces.