trustwallet-revoke-protocol[.]pages[.]dev

The domain trustwallet-revoke-protocol.pages.dev impersonates TrustWallet and has been flagged by 4 out of 91 VirusTotal vendors as malicious. Despite its current offline status, the domain is listed on public blocklists maintained by PhishDestroy, MetaMask, and SEAL. This suggests a significant risk during its active period, particularly given its high platform risk score of 78/100.

The domain was registered through Cloudflare, Inc. and hosted on IP 188.114.96.3 in the United States. The SSL certificate was issued by Google Trust Services, indicating a level of sophistication in mimicking legitimate security practices. The domain's creation on June 15, 2026, and its detection by PhishDestroy just two days later, highlights the rapid deployment and identification of this phishing threat.

The site, titled 'Trust Update', likely aimed to deceive users into believing they were interacting with a legitimate TrustWallet service. By exploiting the brand's name, the attackers sought to harvest sensitive information from unsuspecting users. The quick takedown of the domain underscores the effectiveness of monitoring systems in mitigating such threats, but also serves as a reminder of the persistent risk posed by phishing operations.