trumpaccountsprogramguide.us was an impersonation phishing page dressed up as an enrollment guide for the Trump Accounts program. It targeted parents looking for a promised $1,000 grant for their children. PhishDestroy first saw it on 2026-09-11. The site went offline on 2026-09-13, and its DNS was still inactive at the last check on 2026-10-19.
How the scam works
The page title, "Trump Accounts Program: Who Is Eligible? Kids Eligibility, $1,000 Grant & Enrollment Guide," presents an informational eligibility guide, while we classified the site as impersonation phishing. Schemes of this type borrow the name of a newly announced government benefit and present an official-looking "enrollment" path. That path usually asks for identity details on parents and children, banking information, a processing fee, or a crypto payment or wallet connection. The victim does not receive a grant. Instead they lose money and personal data that can feed identity theft and follow-up scams.
Evidence
On 2026-09-13, 13 of 89 VirusTotal engines flagged the domain, including ChainPatrol, alphaMountain.ai, BitDefender, CRDF, Forcepoint ThreatSeeker, Fortinet, G-Data and Gridinsoft. That is a solid count for a site that was live for only days. The domain is also on the MetaMask and SEAL blocklists alongside PhishDestroy's own. Both are crypto-focused lists, which places the site within the crypto-fraud ecosystem. Three AlienVault OTX threat pulses reference it, so other analysts tracked it independently.
Infrastructure
The domain was registered through Spaceship, Inc. on 2026-06-16, nearly three months before PhishDestroy detected it. A long gap like this often means a domain was held in reserve until a topical lure was ready. It was hosted on Hostinger International's network in Cyprus. A free Let's Encrypt certificate gave it the browser padlock, which says nothing about whether a site is legitimate.
What to do
If you entered your Social Security number, your children's details or ID documents, place a credit freeze and consider an identity-theft alert with the credit bureaus. If you gave card or bank details or paid an "enrollment" fee, contact your bank to dispute the charge and replace the card. If you sent crypto, record the transaction details and report them to the platform you sent from and to law enforcement. Use only official government channels for benefit programs; legitimate programs do not charge fees to enroll. Defenders should block the domain, check DNS and proxy logs for visits since 2026-06-16, and watch for lookalike Trump Accounts domains.
DOM Analysisanalyzed 2026年9月11日score 88/1003 brand signals
Submitted URLhttp://trumpaccountsprogramguide.us/
Favicon Hash
ケース ID
Observed page title
Trump Accounts Program: Who Is Eligible? Kids Eligibility, $1,000 Grant & Enrollment Guide - Trump Accounts
Automated brand references
AcrossCompoundRevolut
TLS証明書
発行者 Let's Encrypt / YE2· stored validity ends in 23 days
Network & certificates
Stored technical evidence
Network & DNS
Resolved IP
2.57.91.184
Network ASN
AS47583
Organization
Hostinger International Limited
Observed location
Larnaca, CY
Server header
hcdn
ネームサーバー 2
cosmos.dns-parking.com
nova.dns-parking.com
Mail routing 2 MX records
mx1.hostinger.compriority 5
mx2.hostinger.compriority 10
Location describes the IP network.
TLS証明書
Issuer
Let's Encrypt / YE2
Valid from
2026-08-15 02:31:12
Valid until
2026-11-13 02:31:11
Hostname coverage
Certificate hostname mismatch
Validity
Within stored validity dates
Collection time
2026-09-11 10:02:07 UTC
Collection source
PhishDestroy collector
Certificate fingerprintba06117fbcc3f58568ecf0500643e08ba94b9f29be8232fbd5d7fecd30fc75b9Certificate names · 1 SANs
www.trumpaccountsprogramguide.us
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Hostnames retained in the domain record or Certificate Transparency cache. A hostname alone does not establish current availability or malicious activity.
www.trumpaccountsprogramguide.usDomain record
The original observation time is not recorded for these hostnames.
使用技術 · 7 identified
W
WordPress
CMSBlogs
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
