trust-waletus[.]pages[.]dev

The domain trust-waletus.pages.dev was observed hosting a page titled "Suspected phishing site | Cloudflare" and is catalogued as a brand‑impersonation campaign targeting Trust Wallet. The site was registered on March 22 2026 through Cloudflare, Inc., and resolves to the Cloudflare edge address 172.66.45.35, which is geolocated to Canada. DNS resolution uses the Cloudflare nameservers erin.ns.cloudflare.com and ryan.ns.cloudflare.com. HTTP requests return a 403 status, and the site enforces HSTS and HTTP/3, indicating modern web server configuration.

The TLS certificate is issued by Google Trust Services under the WE1 intermediate, confirming the use of a legitimate certificate chain. The page is currently taken offline, but the domain remains listed on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal analysis shows the domain has been scanned by 94 vendors without a detection flag; this absence does not constitute evidence of safety.

The available intelligence confirms the domain’s purpose as a Trust Wallet impersonation vector, yet the exact payload, credential‑harvesting mechanisms, and any associated command‑and‑control infrastructure have not been disclosed. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated Cloudflare IP range, and update internal threat intelligence feeds with the observed indicators. Because the site is hosted on a shared Cloudflare infrastructure, any future re‑use of the same sub‑domain or similar naming patterns should be treated as suspicious and investigated promptly.