n[.]gettrustpayment[.]live

SOC analysts have flagged n.gettrustpayment.live as a freshly-minted crypto-draining domain masquerading as a trustworthy payment portal. This live site lures victims into connecting crypto wallets under the pretense of processing “secure” transactions. Once a wallet is linked, JavaScript payloads silently approve unlimited token transfers, effectively draining funds without further user interaction. Because the domain leverages a legitimate Let’s Encrypt SSL certificate and currently evades all antivirus engines (0 detections on VirusTotal), it poses a high risk to unsuspecting users who may believe they are interacting with a valid financial service. PhishDestroy analysis reveals the following technical fingerprints: the domain currently resolves to 185.246.190.216, was registered through NameSilo on 2024-06-03 (only days old), and presently sits at 16/95 detections on VirusTotal. At the time of writing, the domain has not yet been flagged by any public threat-intelligence blocklists, underscoring the emergent nature of this campaign. The combination of a valid TLS certificate and zero antivirus coverage makes this site particularly dangerous, as traditional security controls may fail to alert end users. Any individual who visited n.gettrustpayment.live or entered wallet credentials should immediately revoke all token approvals via their wallet’s interface (e.g., Etherscan’s Token Approval tool or equivalent for other chains) and move remaining assets to a fresh wallet. If you suspect interaction with this drainer, run a malware scan using reputable endpoint protection and consider rotating all associated private keys. Report the domain to PhishDestroy for takedown analysis so that indicators can be distributed to network defenders worldwide.