trust-wollt-extn[.]created[.]app

This domain is flagged as an elevated-risk credential harvesting infrastructure specifically targeting Trust Wallet users through brand impersonation. Analysis indicates the site was designed to harvest cryptocurrency wallet credentials, seed phrases, and private keys from unsuspecting victims under the guise of a legitimate multi-chain wallet extension. Infrastructure analysis reveals the domain trust-wollt-extn.created.app was registered on February 21, 2026 through Tucows Domains Inc. and resolved to IP address 216.150.1.1 (US, AS16509 Amazon.com, Inc.). The site presented a page title reading 'Trust Wallet© Extension⁜ | Secure Multi-Chain Crypto Wallet' and used a Let's Encrypt R13 SSL certificate. Security telemetry shows 18 of 95 vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist. The domain has since been taken offline following detection by automated phishing analysis systems. Mitigation requires immediate action from cryptocurrency users and security teams. All credentials potentially exposed to this domain should be considered compromised and rotated immediately. Users should verify wallet integrity through official Trust Wallet channels only, never through third-party extension sites. Security teams should implement network-level blocking for the domain and associated IP address 216.150.1.1, while monitoring for related infrastructure using the seed identifier cad9e0. Cryptocurrency exchanges and wallet providers should issue warnings to users about this specific credential harvesting campaign targeting wallet extensions.