mainnet[.]real-trump[.]fun

This domain, mainnet.real-trump.fun, is flagged as an active cryptocurrency phishing site designed to exploit the Trump brand. Analysis indicates the site presents itself as a predictive platform titled 'Trump.fun - Predict The Donald's Next Move,' likely luring victims into interacting with fraudulent smart contracts or wallet-draining mechanisms. The infrastructure mimics legitimate crypto engagement tools, a common tactic in phishing campaigns targeting digital asset holders. Infrastructure analysis reveals concrete technical indicators of compromise. The domain was registered on May 02, 2025, through NAMECHEAP INC and currently resolves to IP address 216.150.1.1, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. VirusTotal reports 14 out of 95 security vendors flagging the domain as malicious, while it appears on three distinct security blocklists. The site employs a Let's Encrypt SSL certificate (R12), a tactic frequently observed in phishing operations to create a false sense of security. No legitimate association with the Trump brand or official entities has been verified. As of the latest assessment, mainnet.real-trump.fun remains active and poses a high risk to users. The domain is blocked by multiple security layers, including browser-based protections and wallet security extensions. Despite these mitigations, the site continues to resolve, indicating ongoing malicious intent. Users are advised to avoid interaction, verify domain authenticity through official channels, and report the site to relevant security platforms for further action. The combination of brand impersonation, cryptocurrency targeting, and active hosting underscores the persistent threat posed by this infrastructure.