trust-extt[.]framer[.]media

Analysis of the domain trust-extt.framer.media identifies it as a confirmed phishing infrastructure targeting Trust Wallet users, currently offline as of July 22, 2026. The domain was registered on March 23, 2026, through CSC Corporate Domains, Inc., and resolves to the IP address 31.43.161.6, hosted by Framer B.V. in the Netherlands. Infrastructure analysis reveals the use of Framer Sites, React, HSTS, and HTTP/3 technologies, alongside AWS nameservers (ns-97.awsdns-12.com, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, and others).

The page title, 'Trust Wallet Extension ✦ Secure Web3 Browser Wallet,' directly impersonates Trust Wallet, a cryptocurrency wallet service, aligning with the reported scam type of a crypto scam. Detection by three security blocklists (PhishDestroy, MetaMask, and SEAL) and flagging by 3 of 94 security vendors on VirusTotal further corroborate its malicious classification. The domain's SSL certificate is issued by Let's Encrypt, and it returned an HTTP 404 status at the time of assessment, indicating it is no longer actively serving content.

While the exact content of the phishing page remains unanalyzed, the combination of brand impersonation, blocklist presence, and detection by multiple security vendors confirms its role in fraudulent activity. Defenders are advised to treat this domain as a confirmed phishing threat, block access at the network level, and monitor for related infrastructure. The use of Framer's hosting platform may warrant additional scrutiny of similarly structured domains under the framer.media namespace.