webtrust[.]created[.]app

This domain, webtrust.created.app, presents a direct threat to cryptocurrency users by impersonating Trust Wallet, a legitimate browser-based crypto wallet extension. Analysis indicates the domain hosts a fraudulent interface designed to mimic the official Trust Wallet login and transaction pages. The objective is to deceive users into entering sensitive credentials, such as recovery phrases or private keys, which attackers can then exploit to drain funds from connected wallets. The page title, 'Trust Wallet Extension - Secure Crypto Wallet for Your Browser,' reinforces the deception by closely replicating the branding and messaging of the authentic Trust Wallet service. Evidence supporting the malicious nature of this domain includes detection by 18 out of 95 security vendors on VirusTotal, indicating a consensus among multiple threat intelligence sources. The domain was registered on February 21, 2026, through Tucows Domains Inc., a registrar frequently abused for malicious infrastructure due to its accessibility and bulk registration options. Additionally, the domain appears on one security blocklist, further confirming its association with fraudulent activity. Infrastructure analysis reveals the domain resolves to the IP address 216.150.1.129, which has no prior association with legitimate Trust Wallet services. The SSL certificate, issued by Let's Encrypt (R13), provides basic encryption but does not validate the authenticity of the site, as such certificates are automatically issued to any domain without manual review. Users who have visited webtrust.created.app or interacted with its content should assume their credentials or recovery phrases may have been compromised. Immediate action is required: disconnect any wallets linked to the domain, transfer remaining funds to a new, secure wallet, and revoke any permissions granted to browser extensions associated with the site. Monitor all connected accounts for unauthorized transactions and enable multi-factor authentication where available. If recovery phrases or private keys were entered, consider the affected wallet permanently compromised, as these cannot be revoked or changed. Report the domain to relevant security teams and blocklist providers to prevent further exploitation. Future vigilance is advised, particularly when accessing crypto-related services, to verify domain authenticity and SSL certificate details before entering sensitive information.