trust-wweb3-extension[.]created[.]app

The domain trust-wweb3-extension.created.app was registered on February 21, 2026 through Tucows Domains Inc. and is currently listed as offline. Host resolution points to IP address 216.150.1.129, which belongs to Amazon.com, Inc. AS16509 and is geolocated in the United States. The site presents a TLS certificate issued by Let’s Encrypt (R13) and serves HTTP 404 responses, indicating the landing page is not delivering content at the time of analysis. The page title retrieved from the host is “Trust Wallet Extension - Secure Your Crypto,” directly targeting the Trust Wallet brand and matching the reported scam type of a crypto‑related impersonation.

Technical fingerprints show the use of Node.js, React, Next.js, Vercel hosting, Google Cloud services, LaunchDarkly feature flags, HSTS and Google Cloud CDN, consistent with a modern web application stack. The domain appears on one security blocklist and has been blocked by PhishDestroy, confirming that at least one reputable anti‑phishing service has taken remedial action. Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal scans report four of ninety‑three security vendors flagging the domain, providing additional independent confirmation of malicious intent.

While the site currently returns a 404, the combination of brand‑targeted page title, low trust score, blocklist presence, and vendor detections strongly suggests an active crypto‑scam infrastructure that was recently taken down. Defenders should continue to monitor the domain and associated IP for any re‑appearance, enforce blocking of the domain in corporate web filters, and educate users about unsolicited Trust Wallet extension prompts. Incident response teams should also review related Vercel and Google Cloud DNS records for potential spill‑over assets, and consider sharing the indicator set with threat‑intelligence sharing platforms to aid broader community protection.