trust-wallet-usa[.]pages[.]dev

Analysis indicates that the domain trust-wallet-usa.pages.dev is an active brand impersonation site targeting Trust Wallet users. Registered on April 6, 2026, through Cloudflare, Inc., the domain resolves to the IP address 172.66.46.246 and is hosted under Cloudflare's infrastructure. The page title, 'Trust Wallet — Official Guide,' explicitly suggests an attempt to mimic the legitimate Trust Wallet platform, aligning with the observed threat type of brand impersonation. The domain has been flagged by multiple security vendors, with five out of 95 engines on VirusTotal detecting it as malicious. It appears on three security blocklists and is actively blocked by at least three threat intelligence platforms. The SSL certificate, issued by Google Trust Services, does not mitigate the risk, as phishing domains frequently use valid certificates to appear legitimate. As of July 12, 2026, the domain remains operational, posing a continued threat to users. Defenders should prioritize blocking this domain at the network level and updating detection rules to include its IP address and associated indicators. Given the high-risk classification and active status, users encountering this domain should avoid interaction, and security teams should monitor for related infrastructure that may emerge. The exact content and functionality of the site have not yet been analyzed, but the available evidence confirms its malicious intent.