# trumpgives.help — SUSPICIOUS

> trumpgives.help runs a brand impersonation scam with 0/95 VirusTotal detections. Avoid this crypto drainer posing as political content.

## Summary
PhishDestroy identifies trumpgives.help as a brand impersonation scam actively distributing a crypto drainer posing as political fundraising content. The domain leverages the name 'Trump' to deceive users into connecting cryptocurrency wallets under the guise of donations or giveaways, risking irreversible asset theft. Given the domain's recent registration and lack of blocklist detections, the threat is currently under investigation but remains active and dangerous to unassuming users. Technical indicators, including the SSL certificate from Google Trust Services and hosting on IP 104.21.1.87, suggest a sophisticated setup aimed at evading early detection mechanisms. Users are strongly advised to avoid interactions with this domain until further assessments are completed.  This domain was flagged with the following indicators: created on January 26, 2026, registered through Global Domain Group LLC, resolving to IP 104.21.1.87, and currently showing 0 detections out of 95 scans on VirusTotal. The SSL certificate, issued by Google Trust Services, adds a veneer of legitimacy but does not guarantee safety, as threat actors commonly exploit trusted issuers to bypass security measures. As of now, no reputable blocklists (e.g., Google Safe Browsing, PhishTank) have flagged this domain, indicating a window of opportunity for the scammers to operate undetected. The combination of a freshly minted domain, a crypto drainer payload, and brand impersonation tactics creates a high-risk scenario for cryptocurrency users seeking to engage with political content.  Mitigation steps for this brand impersonation crypto drainer scam include avoiding any interaction with the domain or links associated with trumpgives.help, particularly those promoting political donations or giveaways. Users should verify the authenticity of any fundraising efforts by cross-referencing official websites or trusted news sources before engaging. If a wallet connection is inadvertently made, disconnect immediately and transfer remaining funds to a clean wallet. Report the domain to local cybercrime units or platforms like Google Safe Browsing to aid in its takedown. Enable wallet security features such as withdrawal confirmations and use hardware wallets for added protection against drainer scripts. Stay vigilant against social engineering tactics that leverage current events or trusted brands.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-01-26 03:45:17
- Registrar: Global Domain Group LLC
- IP: 104.21.1.87

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/d4e28012-8cd7-46e9-bec7-01ba96f372e1
- PhishDestroy: https://phishdestroy.io/domain/trumpgives.help/
- LLM endpoint: https://phishdestroy.io/domain/trumpgives.help/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/trumpgives.help/
Last updated: 2026-03-28