walletrusst-cloud[.]created[.]app

This domain, walletrusst-cloud.created.app, poses a targeted brand impersonation threat against Trust Wallet, a widely used cryptocurrency wallet service. The site masquerades as the official Trust Wallet Chrome extension, presenting itself as 'Trust Wallet Extension for Chrome | Official Access to Web3.' Such impersonation is commonly used to deceive users into entering sensitive credentials or installing malicious browser extensions, which can lead to unauthorized access to cryptocurrency holdings or the deployment of crypto-draining malware. The domain’s infrastructure and content are designed to exploit trust in the legitimate Trust Wallet brand, increasing the likelihood of successful social engineering attacks against cryptocurrency users. Analysis of the domain reveals multiple technical indicators supporting its malicious classification. The domain was registered on February 21, 2026, through Tucows Domains Inc., and currently resolves to the IP address 216.150.1.1, hosted on Amazon.com, Inc.’s AS16509 network in the United States. Security vendors on VirusTotal flagged the domain with a detection ratio of 17 out of 95, while it appears on one security blocklist. The SSL certificate is issued by Let’s Encrypt (R13), a common choice for both legitimate and malicious sites due to its free and automated issuance process. The domain has since been taken offline, though its prior activity and infrastructure remain relevant for threat intelligence tracking. Users who visited walletrusst-cloud.created.app should assume potential exposure to credential theft or malware distribution. Immediate actions include revoking any permissions granted to browser extensions installed from the site, resetting passwords for associated accounts, and scanning affected systems for malware. Cryptocurrency users should also review wallet transactions for unauthorized activity and consider migrating funds to a new wallet if compromise is suspected. Monitoring for phishing attempts via email or messaging platforms is advised, as attackers may follow up with additional social engineering tactics. Organizations should update blocklists to include this domain and its associated indicators of compromise to prevent future access.