trust-io-tools[.]pages[.]dev

Analysis of trust-io-tools.pages.dev indicates a recently created domain (registered 08 Oct 2025) that has been used to impersonate the TrustWallet brand. The page title returned by the server reads “Trust Wallet — Secure Multi-Currency Crypto Wallet & Web3”, matching the legitimate brand’s wording and confirming a credential‑stealing intent. The site was classified as Wallet/Seed Phishing, targeting users who may enter their seed phrase or private keys. HTTP responses return a 403 status, and the server advertises HSTS, HTTP/3, and Cloudflare protection, suggesting the payload was hosted behind a Cloudflare front‑end. DNS resolution points to 188.114.97.3, an IP owned by Cloudflare (AS13335) located in the United States, a typical pattern for short‑lived phishing infrastructure that leverages reputable hosting to avoid immediate blocking.

The SSL certificate is issued by Google Trust Services under the “WE1” label, providing a valid TLS chain that can further increase user trust. Two of ninety‑three VirusTotal scanners flagged the domain, and a single security blocklist (PhishDestroy) has already listed it, indicating limited but concrete detection coverage. Gridinsoft’s trust score of 0 / 100 reflects a severe lack of reputation. Nameservers kayden.ns.cloudflare.com and sreeni.ns.cloudflare.com confirm Cloudflare registration. Uncertainty remains regarding the current content of the site because the domain is now offline; no visual or form details have been captured.

Additionally, only one blocklist and two VirusTotal detections are present, so broader detection may be lagging. Defenders should add the domain to internal watchlists, block outbound connections to the IP 188.114.97.3, and enforce strict filtering of any URLs containing the “trust‑io‑tools” sub‑domain pattern. Email security gateways should be updated to flag messages that reference “Trust Wallet” or contain the page title string.