wallet--trust-web[.]pages[.]dev

This domain, wallet--trust-web.pages.dev, is identified as a crypto drainer phishing site designed to illicitly extract cryptocurrency assets from victim wallets. The domain is currently offline, but prior analysis confirms its malicious intent through automated transaction manipulation and wallet credential harvesting. No legitimate brand impersonation was detected; instead, the site employed generic wallet-themed deception to exploit users. Analysis indicates the domain was flagged by 11 of 95 security vendors on VirusTotal, reflecting broad consensus on its malicious nature. Registered through Cloudflare, Inc., it resolved to the IP address 188.114.97.3 and was created on November 07, 2025. The domain appears on three security blocklists, including MetaMask and PhishDestroy, and received a trust score of 0/100 from Gridinsoft. Technical indicators reveal the use of HTTP/3, HSTS, and a Google Trust Services SSL certificate, suggesting an attempt to mimic legitimate security practices while concealing malicious activity. The domain has since been taken offline, likely due to enforcement actions or detection evasion. However, residual risk remains for users who may have interacted with it during its active period. Organizations and individuals are advised to block the domain and its associated IP at the network level, revoke any stored credentials or wallet permissions linked to the site, and monitor transaction logs for unauthorized activity. Users should verify domain authenticity before connecting wallets and employ hardware-based transaction signing to mitigate similar threats.