doc-trust-ask[.]pages[.]dev

This domain, doc-trust-ask.pages.dev, operates as a crypto drainer phishing site designed to compromise digital wallet credentials and exfiltrate cryptocurrency assets. Analysis indicates the infrastructure presents itself as a legitimate document verification or trust service portal, likely impersonating blockchain security protocols or decentralized application interfaces. The page employs social engineering tactics, including fake transaction prompts and wallet connection requests, to trick users into authorizing malicious smart contract interactions that facilitate unauthorized fund transfers from connected wallets. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on October 29, 2025, and currently resolves to the IP address 188.114.97.3. Despite its recent creation, the domain has already been flagged on three security blocklists, including MetaMask's threat intelligence feed, PhishDestroy, and SEAL. Detection metrics show 0 out of 95 engines on VirusTotal currently identify the domain as malicious, suggesting either evasion techniques or delayed detection by security vendors. The site employs HTTP/3 and HSTS protocols, with an SSL certificate issued by Google Trust Services, further attempting to mimic legitimate service infrastructure. Users who visited doc-trust-ask.pages.dev and connected a wallet or entered credentials should immediately revoke all active smart contract approvals through their wallet interface. It is recommended to transfer remaining assets to a new wallet address and monitor transaction histories for unauthorized activity. Browser data should be cleared to remove any stored session tokens or cached malicious content. Given the domain's offline status, affected users should remain vigilant for follow-up phishing attempts through alternative channels, as threat actors may attempt to re-engage compromised targets.