--- title: Operation TrustTrap: A Deceptive Domain Spoofing Campaign description: Cyble Research and Intelligence Labs (CRIL) uncovered Operation TrustTrap, a coordinated phishing campaign involving over 16,800 malicious domains active since... canonical: https://daily.dev/posts/operation-trusttrap-a-deceptive-domain-spoofing-campaign-cwxqjqs2t twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Operation TrustTrap: A Deceptive Domain Spoofing Campaign | daily.dev og:description: Cyble Research and Intelligence Labs (CRIL) uncovered Operation TrustTrap, a coordinated phishing campaign involving over 16,800 malicious domains active since... og:url: https://daily.dev/posts/operation-trusttrap-a-deceptive-domain-spoofing-campaign-cwxqjqs2t og:image: https://api.daily.dev/og/posts/cwXQjQs2t.png og:image:alt: Operation TrustTrap: A Deceptive Domain Spoofing Campaign og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Operation TrustTrap: A Deceptive Domain Spoofing Campaign **[Cyble](https://daily.dev/sources/cyble)** · 11 min read · 0 upvotes · 0 comments ## Summary Cyble Research and Intelligence Labs (CRIL) uncovered Operation TrustTrap, a coordinated phishing campaign involving over 16,800 malicious domains active since early 2026. The campaign exploits cognitive trust by embedding legitimate government domain tokens (e.g., 'mass.gov', 'wa.gov') as subdomains in fraudulent URLs, making them appear as official government portals. Three obfuscation techniques are used: subdomain trust injection, hyphen-based semantic manipulation, and combined strategies. Infrastructure is concentrated on Tencent Cloud and Alibaba Cloud APAC nodes, with Gname.com as the dominant registrar and .bond, .cc, and .cfd as preferred TLDs. Targeting is primarily US-focused (DMV, toll, and vehicle registration portals across all states) but extends to India, Vietnam, and the UK. A distinct cluster within the dataset shows TTPs consistent with APT36 (Transparent Tribe), targeting Indian government entities. Over 62% of domains had very few VirusTotal detections. Recommendations include eTLD+1-aware URL parsing, structural domain risk scoring, and revised security awareness training. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Abusing .arpa: The TLD That Isn’t Supposed to Host Anything](https://daily.dev/posts/abusing-arpa-the-tld-that-isn-t-supposed-to-host-anything-ufmqfbb2j) · Lobsters · 0 upvotes · 0 comments - [Hackers obtain counterfeit TLS certificates for Google and other large services](https://daily.dev/posts/hackers-obtain-counterfeit-tls-certificates-for-google-and-other-large-services-sai4cbgye) · Ars Technica · 1 upvotes · 0 comments - [Borrowed Trust: Cloud DNS Hijack Fuels Gambling SEO Attack](https://daily.dev/posts/borrowed-trust-cloud-dns-hijack-fuels-gambling-seo-attack-l0tliv0ch) · Cyble · 0 upvotes · 0 comments - [Inside a TrickBot Variant Using DNS Tunneling for C2](https://daily.dev/posts/inside-a-trickbot-variant-using-dns-tunneling-for-c2-djwui3hmi) · FortiGuard Threat Research · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/operation-trusttrap-a-deceptive-domain-spoofing-campaign-cwxqjqs2t) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Operation TrustTrap: A Deceptive Domain Spoofing Campaign","url":"https://daily.dev/posts/operation-trusttrap-a-deceptive-domain-spoofing-campaign-cwxqjqs2t","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/operation-trusttrap-a-deceptive-domain-spoofing-campaign-cwxqjqs2t"},"datePublished":"2026-04-24T12:27:45.991Z","dateModified":"2026-04-24T12:28:13.849Z","description":"Cyble Research and Intelligence Labs (CRIL) uncovered Operation TrustTrap, a coordinated phishing campaign involving over 16,800 malicious domains active since...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ef5637c96eabc8aaf3c4bf87cd86fa02?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ef5637c96eabc8aaf3c4bf87cd86fa02?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Cyble","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Cyble","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/345d6009096c4c2da164d9d8e6ccfbe6","url":"https://daily.dev/sources/cyble"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/operation-trusttrap-a-deceptive-domain-spoofing-campaign-cwxqjqs2t","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,phishing","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Cyble","item":"https://daily.dev/sources/cyble"},{"@type":"ListItem","position":3,"name":"Operation TrustTrap: A Deceptive Domain Spoofing Campaign"}]} ```