walletrust-ext[.]my[.]canva[.]site

This domain is flagged as an elevated-risk crypto drainer, a type of attack designed to siphon cryptocurrency assets from victims by mimicking legitimate wallet interfaces. Analysis indicates the domain employs deceptive branding to trick users into authorizing malicious transactions, which irreversibly transfer funds to attacker-controlled addresses. The threat type is particularly insidious due to its reliance on social engineering and the irreversible nature of blockchain transactions. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain walletrust-ext.my.canva.site resolves to IP address 103.169.142.250 and was registered through Gandi SAS on April 03, 2018, though the malicious subdomain likely represents a recent compromise or misuse. It is currently offline but was previously hosted behind Cloudflare, utilizing HSTS and HTTP/3 protocols, which may have been leveraged to evade detection. The SSL certificate is issued by Google Trust Services, adding a superficial layer of legitimacy. Security vendors on VirusTotal flagged the domain at a rate of 8/95, and it appears on three independent blocklists, including those maintained by MetaMask, PhishDestroy, and SEAL. The page title, 'Trust® Wallet Extension⋇ | Get the Trust™ Wallet App* Now,' directly impersonates a well-known cryptocurrency wallet, further confirming the brand impersonation vector. Mitigation against crypto drainers requires a multi-layered approach. Users who interacted with this domain should immediately revoke any connected wallet permissions via blockchain explorers or legitimate wallet interfaces. All transactions originating from the period of exposure should be audited for unauthorized transfers. Wallet software should be updated to the latest version, and hardware-based authentication methods are strongly recommended to prevent future compromise. Domain registrars and hosting providers are advised to monitor subdomains of legitimate platforms for unauthorized use, particularly those employing brand impersonation tactics. Given the irreversible nature of cryptocurrency transactions, prevention through user education and technical controls remains the most effective defense.