m[.]trustwallettmq[.]com

PhishDestroy identifies m.trustwallettmq.com as an active brand impersonation domain targeting Trust Wallet users, operating as a potential crypto drainer. The domain mimics Trust Wallet’s branding to deceive victims into connecting fraudulent wallets or revealing seed phrases. While the exact drainer kit remains under investigation, the domain’s design suggests functionality to siphon cryptocurrency assets upon interaction. Security researchers note that such domains often employ spoofed interfaces or malicious smart contracts to facilitate unauthorized transactions. Users are urged to exercise extreme caution and avoid interacting with this domain or any similar untrusted sources.

Technical indicators for m.trustwallettmq.com confirm its malicious classification. The domain was registered through Gname.com Pte. Ltd. on October 24, 2025, and currently resolves to IP address 47.80.68.7. VirusTotal shows 0 detections out of 95 scans, indicating it has not yet been widely flagged by security engines. The domain holds a valid SSL certificate issued by Let’s Encrypt, which may lend false legitimacy to unsuspecting users. Notably, m.trustwallettmq.com is already blocked by MetaMask and SEAL, and it appears on 2 separate security blocklists. These factors collectively highlight the domain’s emerging but unaddressed threat status.

As of the latest assessment, m.trustwallettmq.com remains active and under investigation, with a current risk level classified as 'under_investigation.' PhishDestroy and collaborating security vendors continue to monitor this domain as part of ongoing brand abuse campaigns. Immediate response actions include active blocking by security tools and inclusion in threat intelligence feeds. However, the lack of widespread detection (VT 13/95) and recent creation date suggest a window of opportunity for threat actors. Users are strongly advised to verify the safety of any Trust Wallet-related domains using PhishDestroy’s database and to refrain from interacting with suspicious links or websites. Remaining risk is moderate due to the domain’s active status and ongoing impersonation campaign, warranting heightened vigilance from both individuals and organizations.