trustwallet[.]com-two-factor-authentication06[.]ao[.]yesixrq[.]com

The domain trustwallet.com-two-factor-authentication06.ao.yesixrq.com was registered on June 13, 2026 through IONOS SE and is currently active. Infrastructure analysis shows the domain resolves to the IPv4 address 77.68.5.178 and is served by the authoritative nameservers ns1.sslwhm.online and ns2.sslwhm.online. The domain appears on one security blocklist and is explicitly blocked by the PhishDestroy feed, indicating that at least one reputable anti‑phishing service has identified it as malicious. VirusTotal scans report that eight of ninety‑five security vendors flag the domain, providing additional corroboration of its malicious nature. The threat classification supplied is a crypto drainer, suggesting the site is used to illicitly capture cryptocurrency credentials or redirect funds. No public Safe Browsing, OTX, or additional vendor detections are listed, so the broader detection landscape remains uncertain. Defenders should add the domain and its resolving IP to block lists at network perimeter devices, DNS filtering services, and endpoint protection solutions. Continuous monitoring of the associated nameservers and IP is advised, as the operators may shift hosting or create additional sub‑domains. Because the domain is newly created and already flagged, rapid response actions—including sink‑hole routing, user education about unsolicited two‑factor authentication prompts, and investigation of any credential exposures linked to the Trust Wallet brand—are recommended to mitigate potential crypto‑draining activity.