trustapp[.]at

The domain trustapp.at is identified as a high-risk brand impersonation threat specifically targeting Trust Wallet, a widely used cryptocurrency and NFT wallet service. This domain was actively distributing fraudulent content designed to deceive users into downloading malicious browser extensions or disclosing sensitive credentials. As of the latest analysis, the domain has been taken offline, though prior activity remains a significant concern for security teams and end-users. Infrastructure analysis reveals that trustapp.at was registered on February 21, 2026, through Gransy s.r.o., a registrar associated with multiple high-risk domains. The domain resolved to the IP address 178.212.12.138, hosted under AS62082 (Hostland LTD) in Russia, a network frequently linked to malicious infrastructure. No SSL certificate was detected, further indicating a lack of basic security measures. The domain was flagged by 21 of 95 security vendors on VirusTotal and appeared on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL. The page title, 'Trust Wallet | Download Extension | Crypto & NFT Wallet,' directly mimicked official Trust Wallet branding to enhance credibility. Current status confirms that trustapp.at is offline, though residual risks persist due to potential DNS caching or future reactivation. Organizations and individuals are advised to block the domain and its associated IP at the network level. Users who may have interacted with the site should immediately revoke any connected wallet permissions, rotate credentials, and scan for unauthorized transactions. Security teams should monitor for similar domains registered through the same registrar or resolving to the same IP range, as these may indicate coordinated threat actor activity. Proactive threat hunting and real-time domain monitoring are recommended to mitigate further exposure.