collect-trustwallet[.]com

This domain, collect-trustwallet.com, is under investigation for operating as a crypto drainer, a threat type designed to siphon cryptocurrency assets from victims' wallets. The domain is currently active and impersonates Trust Wallet, a legitimate cryptocurrency wallet service, to deceive users into interacting with malicious smart contracts or transferring funds to attacker-controlled addresses. Analysis indicates the domain remains operational, with no immediate signs of takedown or mitigation efforts. Infrastructure analysis reveals the domain was registered on June 23, 2026, through Cloudflare, Inc., a registrar frequently leveraged by threat actors to obscure ownership and hosting details. The domain resolves to the IP address 188.114.96.3, which has not been flagged by any of the 95 VirusTotal vendors as of the latest scan. No blocklist entries or trust score degradations were identified, suggesting the domain has evaded detection thus far. The absence of prior alerts or community reporting further complicates attribution and risk assessment. Given the domain's active status and lack of detection by security vendors, the risk of financial loss for users interacting with collect-trustwallet.com remains high. Organizations and individuals are advised to block the domain and its associated IP at the network perimeter. Endpoint protection solutions should be configured to flag any attempts to resolve or connect to this domain. Users who may have interacted with the domain should revoke active wallet sessions, audit transaction histories for unauthorized transfers, and migrate assets to new wallets. Continuous monitoring of related infrastructure is recommended to identify potential pivot domains or IP reuse by the same threat actor.