# PhishDestroy domain threat record: trust-wallet-support-number.pages.dev Content language: English Canonical HTML report: https://phishdestroy.io/domain/trust-wallet-support-number.pages.dev/ Machine-readable companion: https://phishdestroy.io/domain/trust-wallet-support-number.pages.dev/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-15 13:33:03 UTC - Last availability or vendor check: 2026-10-21 01:16:10 UTC - Stored record updated: 2026-10-22 14:24:44 UTC - VirusTotal detections in the stored snapshot: 4/89 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Trust Wallet ## Stored infrastructure - Observed IP address: 172.66.44.75 - Registrar in stored WHOIS data: CloudFlare, Inc. - Last stored HTTP status: 403 - Registration date (registry RDAP, pages.dev): 2020-09-02 02:33:29 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/trust-wallet-support-number.pages.dev - Certificate Transparency search: https://crt.sh/?q=%25.trust-wallet-support-number.pages.dev - Web Archive lookup: https://web.archive.org/web/*/https://trust-wallet-support-number.pages.dev/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview trust-wallet-support-number.pages.dev is an impersonation phishing page that poses as Trust Wallet's customer support. Its target is Trust Wallet users who search for help with a stuck transaction or a missing balance. PhishDestroy first saw it on 2026-09-15. The site went offline on 2026-09-21, and as of 2026-10-19 it remains dead, with its content blocked by the hosting provider. How the scam works The name, with its "support-number" wording, shows the lure. Fake support pages give a phone number, chat box or contact form, and the "agent" behind it asks the victim to confirm the wallet. That usually means typing the 12- or 24-word recovery phrase, or allowing remote access to the phone or computer. Whoever holds the recovery phrase can empty every account in that wallet, and crypto transfers cannot be reversed. The page now carries the title "Suspected Phishing | Cloudflare". That is the host's own warning page shown in place of the Trust Wallet content we classified. Evidence On 2026-09-23, VirusTotal showed 4 of 89 engines flagging the site: alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet and VIPRE. That count is low, so most security tools would not have warned visitors at the time. Crypto-specific blocklists gave stronger coverage. MetaMask and SEAL both list the site alongside PhishDestroy, so wallet users with those protections were warned. Infrastructure The page ran on a free subdomain of Cloudflare Pages, so the operator never had to buy or register a domain. That makes this kind of site cheap to throw away and replace. It was served from Cloudflare, Inc. network space located in Canada. Cloudflare's block is the reason the page now shows a phishing warning instead of the scam. What to do If you contacted this "support" or typed your recovery phrase anywhere on it, treat the wallet as compromised. Create a new wallet with a fresh phrase and move any remaining funds to it immediately. If you gave anyone remote access, remove the remote-access app, scan the device and change the passwords for your email and exchange accounts. Trust Wallet support will never ask for your recovery phrase, and real support does not run on a phone number posted on a random page. Defenders should block the domain and look for other pages.dev subdomains that use wallet brands next to words like "support", "help" or "number". Useful links VirusTotal report: https://www.virustotal.com/gui/domain/trust-wallet-support-number.pages.dev Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=trust-wallet-support-number.pages.dev Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 11:01:09 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e48a0c38-4629-44ef-b54a-ed2b6ed57477.png Captured: 2026-09-22 20:08:40 UTC Source report: https://radar.cloudflare.com/scan/e48a0c38-4629-44ef-b54a-ed2b6ed57477 SHA-256: e9a354897da1a5cddd00510c5d98a54852dc6c725514b7cd4c5fe74ae17ff2fb - URLScan ยท 2026-09-15: https://screenshots.phishdestroy.io/us/01a0a548-7512-761b-bb05-1f2fe487feb2.png Captured: 2026-09-15 13:36:30 UTC Source report: https://urlscan.io/result/01a0a548-7512-761b-bb05-1f2fe487feb2/ SHA-256: 87e2f686496413d01cb320f51ec42a64d452bcb649106922ffbe2bf01f3309f5 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T22:30:11Z", "uuid": "e48a0c38-4629-44ef-b54a-ed2b6ed57477", "scanned_at": "2026-09-22T20:08:40Z", "final_url": "https://trust-wallet-support-number.pages.dev/", "status": 403, "history": [ { "url": "https://trust-wallet-support-number.pages.dev/", "status": 403 } ], "dom_hash": "9a6eba1ecbd2330d21371baacdbe2749d9444c15f6db23074fdf0e34c869bc51", "doc_hash": "3ec398ce48f44bcce3df92c348855ad25e8f1e1c02a28a6aeb3152329247cde1", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "trust-wallet-support-number.pages.dev", "type": "A", "value": "172.66.44.75" }, { "name": "trust-wallet-support-number.pages.dev", "type": "A", "value": "172.66.47.181" }, { "name": "trust-wallet-support-number.pages.dev", "type": "AAAA", "value": "2606:4700:310c::ac42:2c4b" }, { "name": "trust-wallet-support-number.pages.dev", "type": "AAAA", "value": "2606:4700:310c::ac42:2fb5" } ], "dnssec_valid": false, "ip": "172.66.44.75", "whois": { "registrar": "CloudFlare, Inc.", "created": "2020-09-02T02:33:29Z", "updated": "2026-06-09T12:00:52Z", "expires": "2027-09-02T02:33:29Z", "nameservers": [ "adi.ns.cloudflare.com", "karl.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T00:31:41Z", "analysis_at": "2026-09-28T00:48:44Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "registrar": "CloudFlare, Inc.", "created": "2020-09-02T02:33:29Z", "expires": "2026-09-02T02:33:29Z", "updated": "2025-03-17T14:56:22Z", "first_seen": "2025-06-28T15:13:33Z", "dns": [ { "ttl": 300, "type": "A", "value": "172.66.47.181" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:310c::ac42:2fb5" }, { "ttl": 21600, "type": "NS", "value": "mitchell.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "abby.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.66.44.75" }, { "ttl": 21600, "type": "NS", "value": "abby.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:310c::ac42:2c4b" } ], "dns_at": "2026-09-28T00:52:41Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "trust-wallet-support-number.pages.dev", "*.trust-wallet-support-number.pages.dev" ], "issuer": "Google Trust Services / WE1", "serial": "ba076a60073fef100e543430616050cf", "sha256": "e6cf04727e3cfbd7da1bdd15c539db5878f33b2dc910b5a027ca2bdfa7499f0a", "subject": "trust-wallet-support-number.pages.dev", "valid_to": "2026-11-13T18:23:39Z", "valid_from": "2026-08-15T17:23:52Z" }, "whois": { "registrar": "CloudFlare, Inc.", "registrar_iana_id": "1910", "registrar_url": "None", "created": "2020-09-02T02:33:29Z", "updated": "2023-09-04T18:15:07Z", "expires": "2026-09-02T02:33:29Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited", "clientdeleteprohibited", "clienttransferprohibited", "clientupdateprohibited" ], "nameservers": [ "adi.ns.cloudflare.com", "karl.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```