trumpnewguy[.]pages[.]dev

PhishDestroy identifies trumpnewguy.pages.dev as a crypto-draining phishing page designed to trick users into connecting their digital wallets under the guise of a political endorsement. Once a victim clicks through, the page prompts wallet connection under fake “support” messages, quietly draining tokens to attacker-controlled addresses. Researchers note this page is part of a broader campaign impersonating high-profile figures to spread wallet drainers across social media platforms.

Cloudflare’s infrastructure hosts this domain, which was registered through Cloudflare, Inc. and first observed resolving to IP 188.114.97.3 on [date not provided]. VirusTotal currently shows 0 detections out of 95 engines, indicating the payload remains undetected by most antivirus platforms. The domain uses a Google Trust Services SSL certificate to appear legitimate, adding to its deception. Despite low detection rates, the site’s behavior—prompting immediate wallet connections—strongly signals malicious intent.

If you visited this site, immediately disconnect your wallet and revoke any connected permissions using your wallet’s “Connected Apps” or “Revoke Access” feature. Do not approve any unexpected transactions or sign messages. Report the domain to PhishDestroy and consider transferring remaining assets to a fresh wallet. Always verify URLs before interacting and use a browser extension like PhishDestroy to block known malicious sites in real time.