trx-trust[.]com

This domain, trx-trust.com, is actively facilitating crypto wallet drainer attacks, a threat type designed to siphon digital assets from unsuspecting users. Analysis indicates the site mimics legitimate cryptocurrency wallet interfaces, tricking victims into connecting their wallets or entering private keys. Once access is granted, malicious scripts execute unauthorized transactions, transferring funds to attacker-controlled addresses without user consent. The threat is particularly insidious due to its ability to bypass basic security checks and exploit trust in decentralized finance platforms. Infrastructure analysis reveals multiple red flags corroborating the malicious nature of this domain. The domain is flagged by 4 out of 95 security vendors on VirusTotal, including specialized crypto threat detection engines. It appears on three independent security blocklists and is actively blocked by wallet security tools and browser extensions. The domain was registered on February 27, 2024, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It currently resolves to the IP address 172.67.166.22, which is part of a network range known for hosting phishing and fraudulent sites. The page title 'Just a moment...' is consistent with cloaking techniques used to evade automated detection systems. Users who have visited trx-trust.com or interacted with its content should take immediate action to mitigate potential damage. First, disconnect any wallets that may have been linked to the site and revoke all associated smart contract approvals using a trusted blockchain explorer. Monitor wallet activity for unauthorized transactions and transfer remaining assets to a new, secure wallet. If private keys or seed phrases were entered, consider the compromised wallet permanently at risk and cease all use. Report the domain to relevant security platforms to aid in broader threat intelligence efforts. Given the elevated risk level, users are advised to enable multi-factor authentication on all crypto-related accounts and verify domain authenticity before any interaction.