trumpfundus[.]com

PhishDestroy identifies trumpfundus.com as an active crypto drainer impersonating TRUMP COIN, a high-risk threat designed to trick users into connecting wallets and draining cryptocurrency assets. This domain was flagged as under_investigation with a risk level escalating due to its malicious infrastructure and evasion tactics. The site leverages the guise of TRUMP COIN—a crypto token associated with political branding—to lure victims into exposing their wallets to a drainer script. Technical indicators reveal a newly registered domain with no legitimate affiliations, created specifically to deceive cryptocurrency users seeking token exposure or investment opportunities. This domain exhibits multiple red flags consistent with malicious operations. Registered through Global Domain Group LLC, trumpfundus.com resolves to IP 104.21.68.184 and has already been placed on 2 security blocklists. Despite appearing on these lists, it remains undetected by 0 of 95 VirusTotal engines, indicating low signature coverage and high evasion potential. The domain uses a Let’s Encrypt SSL certificate to appear legitimate, created on April 19, 2026—an unusually recent date suggesting opportunistic registration targeting current events. Defensive responses are already active: MetaMask and SEAL have blocked the domain, reflecting proactive detection by security platforms, though VirusTotal’s zero detection rate highlights a critical gap in automated scanning. The combination of a fake crypto asset, zero detections, and rapid domain age elevates the threat to active and potentially escalating. Mitigation for this crypto drainer threat requires immediate and cautious action. Users should never connect wallets to unfamiliar or unsolicited crypto sites, especially those referencing political figures or branded tokens like TRUMP COIN. Verify any crypto-related domain using PhishDestroy’s real-time scanner before interaction. If exposure has occurred, disconnect the wallet immediately, revoke unauthorized permissions via blockchain explorers, and transfer remaining assets to a clean wallet. Organizations should block the IP 104.21.68.184 and domain at network and DNS levels. Continuous monitoring is essential, as zero detections suggest this campaign may expand undetected across platforms. Always inspect SSL certificates, domain age, and blocklist status using tools like PhishDestroy to avoid falling victim to such rapidly evolving crypto scams.