trustwallet-setup[.]web[.]app

This domain is flagged as a high-risk brand impersonation site designed to deceive users of Trust Wallet, a cryptocurrency wallet service. The site mimics the legitimate Trust Wallet interface to trick visitors into entering sensitive information, such as recovery phrases or private keys, which can lead to unauthorized access and theft of digital assets. The threat is classified as brand impersonation, a tactic commonly used to exploit trust in well-known services for fraudulent purposes. Analysis indicates the domain was registered through Google Firebase on May 19, 2026, and currently resolves to the IP address 199.36.158.100, hosted by Google LLC in the United States. The SSL certificate is issued by Google Trust Services (WR4), and the page title is displayed as 'TrustWallet.' Security vendors have detected this domain on three blocklists, with VirusTotal reporting 2 out of 95 vendors flagging it as malicious. The domain remains active and is blocked by multiple security frameworks, including PhishDestroy, MetaMask, and SEAL. If you have visited trustwallet-setup.web.app or interacted with its content, immediate action is required. Disconnect any devices used to access the site from the internet to prevent further exposure. Revoke any permissions granted to unknown applications or browser extensions linked to the domain. If sensitive information such as recovery phrases or private keys was entered, transfer all assets from the compromised wallet to a new, secure wallet immediately. Monitor accounts for unauthorized transactions and report the incident to the legitimate Trust Wallet support team for further guidance.