trustwalet-web[.]created[.]app

This domain, trustwalet-web.created.app, presents a direct brand impersonation threat targeting Trust Wallet users by mimicking its official browser extension interface. The page titled 'Trust Wallet Extension – Secure Browser Access to Your Crypto' is designed to deceive visitors into downloading malicious software, granting attackers access to cryptocurrency wallets, private keys, or sensitive credentials. Analysis indicates the infrastructure was specifically crafted to exploit user trust in the legitimate Trust Wallet brand, a common tactic in cryptocurrency phishing campaigns. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on February 21, 2026, through Tucows Domains Inc., and currently resolves to IP address 216.150.1.65, hosted on Amazon.com, Inc. (AS16509) infrastructure. Security vendors flagged this domain in 18 out of 95 VirusTotal scans, while it appears on at least one security blocklist. The SSL certificate, issued by Let's Encrypt (R13), provides minimal encryption but does not validate legitimacy. Despite its current offline status, the domain's creation date and detection metrics suggest a coordinated effort to distribute fraudulent browser extensions. Users who visited trustwalet-web.created.app or interacted with its content should take immediate remedial action. Any downloaded files or extensions must be removed from devices, and all active browser sessions should be terminated. Cryptocurrency wallet users should revoke any connected browser permissions and transfer assets to a new wallet if credentials were entered. System scans using updated security tools are recommended to detect potential malware. Due to the elevated risk of credential theft, password resets for associated accounts are strongly advised. Monitoring for unauthorized transactions and enabling multi-factor authentication on all financial platforms can mitigate further exposure.