trustwallet--com[.]pages[.]dev

Analysis indicates that the domain trustwallet--com.pages.dev is registered via Cloudflare, created on March 06, 2026, and resolves to IP address 172.66.47.117 owned by Cloudflare (AS13335) in the United States. The site serves traffic over HTTPS using a certificate issued by Google Trust Services (WE1) and enforces HSTS while supporting HTTP/3. The page title observed is "Trust Wallet | Secure and Private Crypto Wallet for Web3", directly referencing the TrustWallet brand and confirming a brand‑impersonation attempt. HTTP response code 451 was returned, indicating that the content is unavailable for legal reasons, and the domain is currently listed as offline.

Security intelligence shows the domain appears on one security blocklist and is blocked by PhishDestroy; the Gridinsoft trust score is 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal analysis recorded three of ninety‑four scanners flagging the domain, further corroborating the malicious assessment. The combination of brand targeting, the crypto scam classification, and the elevated risk level aligns with known threat actors who leverage Cloudflare‑hosted infrastructure to mimic legitimate cryptocurrency wallet services. Concrete details about the phishing kit, page content, or payload are not available, leaving the exact user‑interaction flow uncertain.

Defenders should continue to block the domain at perimeter firewalls, update URL filtering and DNS threat‑list rules, and monitor for additional domains that use similar naming patterns or share the same IP or nameserver configuration (imani.ns.cloudflare.com and piotr.ns.cloudflare.com). Threat‑hunting activities can use the observed IP and nameserver data to locate related infrastructure. Ongoing feed monitoring is recommended to detect any re‑hosting attempts of this impersonation campaign.