trast-wallett[.]pages[.]dev

On July 12, 2026, the domain trast-wallett.pages.dev was observed hosting a credential-harvesting page that mimics the official Trust Wallet interface. The page title reads “Trust Wallet: Manage, Swap & Earn Crypto Securely,” directly copying the branding of the target wallet application. The site is classified as a high-risk brand-impersonation campaign. Infrastructure analysis shows the domain is registered through Cloudflare, Inc. on April 6, 2026 and resolves to the Cloudflare edge address 172.66.47.143, which is geo-located to Canada. Authoritative nameservers are mark.ns.cloudflare.com and rachel.ns.cloudflare.com. The site presents a valid TLS certificate issued by Google Trust Services under the WE1 root, indicating encrypted HTTPS delivery. An HTTP GET returns status code 200, confirming the page is actively served. Threat intelligence indicates the page employs a known “Seed Phrase Phishing” kit, designed to lure users into disclosing their wallet recovery phrases. VirusTotal scans have flagged the domain by one of ninety-five security vendors, and the Gridinsoft trust score is 0 out of 100, reinforcing the malicious intent. The domain is currently listed on a single security blocklist and has been flagged by PhishDestroy, yet it remains active. Defenders should add the IP address 172.66.47.143 and the domain trast-wallett.pages.dev to network and DNS blocklists, monitor Cloudflare name-server traffic for similar patterns, and enforce web-proxy inspection for HTTPS traffic to detect the seed-phrase collection form. End-user awareness campaigns must emphasize that the official Trust Wallet service never requests private recovery phrases via web pages, and any unsolicited prompts should be reported immediately.