trust-walet[.]pages[.]dev

The domain trust-walet.pages.dev is identified as a high-risk brand impersonation threat targeting Trust Wallet, a cryptocurrency wallet service. Analysis confirms this domain was designed to deceive users into installing a fraudulent browser extension under the guise of enhancing their crypto experience. The page title, 'Trust Wallet Extension – Enhance Your Crypto Experience,' directly mimics legitimate Trust Wallet communications to exploit user trust in the brand. Current status indicates the domain has been taken offline, though prior activity remains a documented risk. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain was registered through Cloudflare, Inc. on October 09, 2025, and resolves to the IP address 188.114.96.3. Security vendors flagged the domain on VirusTotal, with 10 out of 95 engines detecting it as malicious. Additional red flags include a Gridinsoft trust score of 0/100 and presence on three security blocklists. The domain employs HSTS and HTTP/3 protocols, likely to lend an appearance of legitimacy, while its SSL certificate is issued by Google Trust Services, a common tactic to evade basic security checks. The current offline status of trust-walet.pages.dev does not eliminate the risk posed by this infrastructure. Historical activity suggests the potential for reactivation or migration to similar domains. Users and organizations are advised to block the domain and its associated IP (188.114.96.3) at the network level. Cryptocurrency wallet users should verify all browser extensions through official sources only, avoiding third-party download links. Security teams should monitor for domains with similar naming patterns (e.g., 'walet,' 'trustwallet-ext') and update detection rules to include this domain’s technical indicators. Proactive measures, such as user education on brand impersonation tactics and enforcement of strict extension installation policies, are recommended to mitigate future risks.