trustwallet-teampages-supports[.]webflow[.]io

trustwallet-teampages-supports.webflow.io is currently active and has been classified as a high‑risk crypto drainer. The domain was registered through Webflow, Inc., a popular SaaS platform that provides hosting for user‑generated sites. DNS resolution points to the IP address 104.18.36.248, which belongs to the Cloudflare network and is commonly used for legitimate web services as well as for malicious hosting. No authoritative nameserver records were returned, indicating that the domain relies on Webflow’s default DNS configuration. VirusTotal analysis shows that 2 of 91 security vendors have flagged the domain, suggesting that at least a minority of scanners have identified malicious characteristics.

The domain is listed on three public blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services, reinforcing the consensus that the site is being used for phishing or credential harvesting related to cryptocurrency wallets. The specific threat category is recorded as “crypto drainer,” implying that the site likely attempts to solicit private keys, seed phrases, or transaction authorizations from victims in order to exfiltrate funds. Available intelligence does not include a page title, SSL certificate details, HTTP status codes, or any observed content, so the exact luring technique employed by the site remains unknown. Likewise, there is no information on the underlying phishing kit or any observed command‑and‑control infrastructure. Defenders should therefore treat any traffic to or from the domain as suspicious.

Blocking the domain at the network perimeter, updating DNS filtering policies, and adding the IP address 104.18.36.248 to deny lists are recommended immediate actions. The high risk rating reflects the potential financial impact of a successful credential harvest, as crypto drainer operations can result in immediate loss of digital assets without recourse.