extend-trust-wallet[.]com

This domain is flagged as an elevated-risk brand impersonation site targeting Trust Wallet, a cryptocurrency wallet service. Analysis indicates the site is designed to deceive users into believing it is an official Trust Wallet extension or support page, likely to facilitate credential harvesting or crypto asset theft. The specific threat type is brand impersonation, a tactic commonly used to exploit user trust in established brands for fraudulent purposes. Infrastructure analysis reveals the domain extend-trust-wallet.com was registered on April 08, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3. It is detected by 5 out of 95 security vendors on VirusTotal and appears on 3 security blocklists, including MetaMask and PhishDestroy. The domain has a Gridinsoft trust score of 0/100 and was identified in one threat intelligence pulse on AlienVault OTX. The SSL certificate is issued by Let's Encrypt, and the page title displayed is 'Redirecting...', suggesting the site may have been used to forward victims to another malicious endpoint or phishing page. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP address (188.114.96.3) at the network level. Organizations should update security blocklists to include this domain and monitor for any attempts to access it internally. Users who may have interacted with the site should be advised to revoke any connected wallet permissions, rotate credentials, and scan their systems for malware. Additionally, security teams should conduct a retrospective analysis of logs to identify any prior access attempts or successful connections to the domain, particularly in environments where cryptocurrency-related activities are common.