trumpgive[.]org

This domain, trumpgive.org, is identified as a crypto drainer phishing site designed to compromise cryptocurrency wallets by tricking users into executing malicious transactions. The site employs social engineering tactics, likely impersonating political fundraising or donation platforms, to deceive victims into connecting their wallets to a fraudulent interface. Once connected, the site deploys JavaScript-based drainer scripts to siphon funds without user consent, a common tactic in cryptocurrency theft campaigns. Analysis of the domain reveals multiple high-risk indicators. The domain was registered on July 07, 2025, through Regional Network Information Center, JSC dba RU-CENTER, a registrar frequently associated with malicious infrastructure. It appears on three security blocklists and is flagged by 11 out of 95 security vendors on VirusTotal, indicating widespread detection. The domain resolves to IP address 172.67.150.21, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic to evade takedowns. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing sites often leverage valid certificates to appear legitimate. Users who visited trumpgive.org or interacted with its content should take immediate action. Disconnect any cryptocurrency wallets linked to the site and revoke permissions for all connected decentralized applications (dApps). Scan the device for malware using updated security tools, as drainer scripts may deploy additional payloads. Monitor wallet transactions for unauthorized activity and consider transferring remaining funds to a new wallet if compromise is suspected. Report the domain to relevant security teams or blocklist providers to aid in broader mitigation efforts.