# trmlabscoin.cyou — SUSPICIOUS

> PhishDestroy identifies trmlabscoin.cyou as a live fake crypto wallet drainer targeting TRM Labs users. VT score 0/95. Check the full report.

## Summary
PhishDestroy identifies the domain trmlabscoin.cyou as a live fake-crypto-wallet phishing page posing as TRM Labs’ official portal. The site appears to host a drainer kit designed to siphon cryptocurrency from unsuspecting wallet holders who enter seed phrases or connect wallets. No exact kit fingerprint is available yet, but the page mimics TRM Labs’ branding and layout to deceive visitors.

Technical indicators reveal the domain resolves to 103.68.172.240 and was registered through Gname.com Pte. Ltd. on March 24, 2026; VirusTotal currently rates it 0/95 detections, it carries a Let’s Encrypt SSL certificate, and remains unlisted in Google Safe Browsing. Public blocklist checks show zero current matches, indicating the infrastructure is newly active and largely unclassified.

The campaign is marked active and under investigation; no immediate takedown has occurred. Users should avoid visiting trmlabscoin.cyou and block the IP 103.68.172.240 at the network perimeter. The residual risk remains high while the site remains live and undetected by most engines, so monitor wallet activity and report any suspicious transactions immediately.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-24 16:02:25
- Registrar: Gname.com Pte. Ltd.
- IP: 103.68.172.240

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/d69741da-5158-40b5-a551-095a43c4f543
- PhishDestroy: https://phishdestroy.io/domain/trmlabscoin.cyou/
- LLM endpoint: https://phishdestroy.io/domain/trmlabscoin.cyou/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/trmlabscoin.cyou/
Last updated: 2026-03-26