trumpwallet[.]site

This domain, www.trumpwallet.site, is flagged as an active cryptocurrency scam operating since February 21, 2026. Analysis indicates it functions as a crypto drainer, a threat type designed to siphon digital assets from victims' wallets. The domain resolves to IP address 185.207.0.110, hosted on infrastructure belonging to AS198610 Beget LLC, a provider based in Russia. The site currently returns an HTTP 200 status, confirming its operational status as of July 12, 2026, though no SSL certificate is present, increasing the risk of interception or manipulation of user data. Infrastructure analysis reveals the domain uses nameservers ns1.beget.com, ns2.beget.com, ns1.beget.pro, and ns2.beget.pro, consistent with the registrar Beget LLC. Security vendors have begun detecting this domain, with two out of ninety-five flagging it as malicious on VirusTotal. While the exact content of the site remains unanalyzed, the page title matches the domain name, suggesting a direct impersonation or branding strategy. The absence of a recognized brand in the provided data prevents confirmation of any specific entity being mimicked beyond the generic crypto wallet theme implied by the domain name. Defenders should treat this domain as high-risk due to its confirmed crypto drainer classification and active status. Network-level blocking is recommended for the domain and its associated IP 185.207.0.110. Security teams should monitor for connections to this infrastructure, particularly in environments where cryptocurrency transactions occur. Given the domain's recent creation and low detection rate, additional variants or related infrastructure may emerge, warranting proactive threat hunting for similar naming patterns or hosting providers. No further technical details about the drainer mechanism or victim targeting are available at this time.