trusted-trader[.]app

This domain, trusted-trader.app, is identified as a high-risk phishing infrastructure targeting cryptocurrency users under the guise of a wallet risk analysis and anti-money laundering (AML) compliance platform. Analysis of the page title, TrustedTrader - Advanced Crypto Wallet Risk Analysis & AML Compliance, indicates an attempt to impersonate legitimate cryptocurrency security tools, likely to deceive users into connecting wallets or entering sensitive credentials. The domain exhibits characteristics consistent with crypto drainer kits, which are designed to siphon digital assets upon interaction. No direct brand impersonation of a specific entity is observed, but the thematic focus on crypto wallet security suggests a broad targeting approach within the cryptocurrency ecosystem. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain resolves to the IP address 216.198.79.1 and was registered through Vercel Inc. on March 04, 2026. It is currently flagged by 9 out of 95 security vendors on VirusTotal, with Google Safe Browsing categorizing it under SOCIAL_ENGINEERING. The domain appears on four independent security blocklists and is actively blocked by MetaMask, PhishDestroy, SEAL, and InversionDNS. The creation date, registrar, and hosting provider align with patterns observed in ephemeral phishing campaigns, where domains are rapidly deployed and discarded to evade detection. As of the latest assessment, trusted-trader.app has been taken offline, likely in response to security vendor flagging and blocklisting. However, residual risk persists due to the potential for the operators to redeploy the infrastructure under a new domain or IP address. Users who may have interacted with the domain are advised to revoke any connected wallet permissions, monitor transaction histories for unauthorized activity, and report the incident to relevant cryptocurrency security platforms. Organizations are recommended to update blocklists with the provided indicators of compromise (IOCs) and conduct retrospective analysis to identify any prior exposure within their networks.