trrust-tool-pages[.]pages[.]dev

This domain, trrust-tool-pages.pages.dev, operates as a credential theft platform targeting cryptocurrency users. Analysis indicates the site likely harvests wallet credentials or login details through deceptive interfaces mimicking legitimate crypto services. The threat primarily affects users who interact with decentralized finance platforms or digital asset management tools, where stolen credentials can lead to unauthorized access and asset drainage. Infrastructure analysis reveals the domain was registered on April 02, 2026, through Cloudflare, Inc., and currently resolves to the IP address 172.66.47.179. Despite zero detections out of 95 engines on VirusTotal, the domain appears on three security blocklists, including MetaMask and PhishDestroy, suggesting targeted detection by specialized crypto security tools. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy while the page title explicitly states 'Suspected phishing site | Cloudflare,' indicating internal detection by the hosting provider. Users who visited this domain should immediately revoke any active sessions and change credentials for all crypto-related accounts. Monitor wallet addresses for unauthorized transactions and consider rekeying or migrating assets to new wallets if direct interaction occurred. The domain's current offline status does not eliminate risk, as harvested credentials may still be exploited. Security teams should add the domain and associated IP to blocklists, and users should verify any future communications from crypto services through official channels only.