trst-en-web-wallt[.]pages[.]dev

This domain, trst-en-web-wallt.pages.dev, is confirmed to operate as a credential harvesting site targeting web-based authentication portals. Analysis indicates the infrastructure was designed to mimic legitimate wallet or financial service login interfaces, with the intent to capture usernames, passwords, and multi-factor authentication codes. The domain exhibits characteristics consistent with large-scale phishing campaigns, including the use of Cloudflare-hosted pages to evade detection and maintain operational security. Infrastructure analysis reveals the domain was registered through Cloudflare on March 23, 2026, and resolves to the IP address 188.114.96.3. Despite zero detections in VirusTotal’s 95-engine scan, the domain appears on three independent security blocklists and is actively blocked by multiple browser-based protection systems. The SSL certificate is issued by Google Trust Services, a common tactic to lend false legitimacy to phishing sites. Technologies detected include HSTS and HTTP/3, which are frequently exploited to enhance the perceived authenticity of malicious pages. Users who visited trst-en-web-wallt.pages.dev should immediately revoke any entered credentials and monitor associated accounts for unauthorized activity. If authentication details were submitted, reset passwords across all platforms where the same credentials may have been reused. Enable multi-factor authentication on critical accounts and review recent login attempts for anomalies. Network administrators should add the domain and its resolving IP (188.114.96.3) to internal blocklists to prevent further access. Given the domain’s current offline status, continued monitoring for re-emergence under similar naming conventions is recommended.