data-trust[.]wasmer[.]app

The domain data-trust.wasmer.app was identified on July 12, 2026 as an active impersonation site targeting the Trust Wallet brand. The site presents a page titled “Trust Wallet Extension — Easy dApp & Token Management,” mimicking the official extension interface to lure users into credential or private‑key submission. Infrastructure analysis shows the domain resolves to the IPv4 address 62.210.172.150, hosted in France under AS12876 Scaleway SAS. DNS is served by alpha.ns.wasmernet.com and beta.ns.wasmernet.com. The web server delivers HTTP 200 responses and uses a valid Let’s Encrypt certificate (YE2), indicating a correctly configured TLS endpoint. The underlying stack consists of WordPress with MySQL and PHP, a common combination for content‑driven sites. Security telemetry reports a Gridinsoft trust score of 0 / 100 and a single security blocklist entry. VirusTotal flags the domain with one positive out of ninety‑five scanners, and the site is currently listed by PhishDestroy as a blocked impersonation source. While the visible front‑end clearly copies the Trust Wallet branding, no malicious payload or credential‑harvesting form has been captured in the public snapshot. Consequently, the precise level of data exfiltration risk remains uncertain, and the presence of additional backend components cannot be ruled out without deeper forensic inspection. Defenders should treat the domain as high‑risk and add data-trust.wasmer.app to network and endpoint blocklists. Continuous monitoring of the associated IP range and the Wasmer nameservers is advised, as well as user awareness campaigns warning against unsolicited Trust Wallet extension prompts. Remediation actions include sink‑holing the IP and reporting the abuse to the hosting provider.