# trader.payscrow.io — SUSPICIOUS

> PhishDestroy identifies trader.payscrow.io as a crypto drainer impersonating Payscrow. Resolves to 104.20.30.

## Summary
trader.payscrow.io has been flagged for active crypto drainer activity under PhishDestroy’s investigation pipeline (seed: 1783b0). This domain mimics the legitimate Payscrow platform to trick users into connecting crypto wallets and authorizing malicious token approvals. The threat type is a high-risk crypto drainer, designed to silently siphon assets once wallet permissions are granted. The domain is currently classified as active with a risk level marked as under_investigation, pending deeper behavioral analysis.  

This domain was registered through Namecheap Inc on July 05, 2023, and resolves to IP address 104.20.30.157. VirusTotal currently shows 0/95 detection engines flagging the domain, indicating low immediate signature-based detection but not confirming safety. The domain holds a valid SSL certificate issued by Google Trust Services, which does not inherently indicate legitimacy in phishing contexts. Historical and real-time blocklist checks should be conducted to assess prior abuse or current takedown status.  

Users are strongly advised to avoid interacting with trader.payscrow.io or any linked crypto wallet connection prompts. To confirm legitimacy, manually verify Payscrow’s official domain (payscrow.io) via trusted sources or browser bookmarks. Never approve token permissions or connect wallets from unsolicited links. Report suspicious domains immediately to PhishDestroy for rapid classification and takedown support. Always cross-check domains against verified brand domains before any digital asset transaction.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2023-07-05 12:43:27
- Registrar: NAMECHEAP INC
- IP: 104.20.30.157

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/153afce7-ae6f-4ece-a42d-ede1f1fb7e9b
- PhishDestroy: https://phishdestroy.io/domain/trader.payscrow.io/
- LLM endpoint: https://phishdestroy.io/domain/trader.payscrow.io/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/trader.payscrow.io/
Last updated: 2026-03-22