trest-wallett[.]pages[.]dev

This domain, trest-wallett.pages.dev, is actively engaged in brand impersonation targeting Trust Wallet, a cryptocurrency wallet service. The phishing page replicates the legitimate Trust Wallet interface, using the page title 'Trust Wallet: Manage, Swap & Earn Crypto Securely' to deceive users into entering sensitive credentials or wallet recovery phrases. Analysis indicates the site is designed to harvest cryptocurrency wallet details, likely functioning as a crypto drainer or credential harvester, though no specific drainer kit signature has been confirmed at this time.

Infrastructure analysis reveals the domain is registered through Cloudflare, Inc., resolving to the IP address 172.66.44.68, geolocated to Canada. The domain was created on April 06, 2026, and remains active despite limited detection coverage. VirusTotal reports 1 out of 95 security vendors flagging the domain as malicious. The domain appears on a single security blocklist (PhishDestroy) and is not currently listed on Google Safe Browsing. The SSL certificate is issued by Google Trust Services (WE1), a common practice for both legitimate and malicious sites leveraging Cloudflare’s infrastructure.

As of the latest verification, trest-wallett.pages.dev remains operational, posing a continued risk to users. The low detection rate (1/95) suggests the infrastructure may evade automated defenses, increasing the likelihood of successful phishing attempts. Recommended response actions include blocking the domain at the network level, updating endpoint protection rules to include the IP address 172.66.44.68, and alerting users to the specific threat. Despite its limited blocklist presence, the domain’s active status and targeted impersonation of a high-value crypto service warrant elevated monitoring and proactive mitigation.