v[.]gettrustpayment[.]live

PhishDestroy identifies v.gettrustpayment.live as an active crypto drainer domain leveraging brand impersonation tactics to deceive cryptocurrency users. The domain mimics legitimate payment processors, specifically targeting trust-based transactions to siphon funds via malicious smart contract interactions. Research indicates the threat actor employs a drainer kit designed to exploit wallet approval mechanisms, redirecting funds to controlled addresses in near real-time. This domain was flagged under seed 167b75 during routine IOC monitoring of emerging crypto fraud campaigns. This domain resolves to IP address 185.246.190.216 and operates under a Let's Encrypt SSL certificate, adding false legitimacy to its operations. As of current analysis, the domain shows 0 detections on VirusTotal (23/95 engines). The domain was registered through an anonymized registrar and shows no current presence on Google Safe Browsing blacklists despite its active malicious operations. Historical records indicate recent creation, though exact registration date remains under investigation as part of ongoing analysis. The domain remains active with an under investigation status, presenting elevated risk due to its zero detection rate and use of legitimate infrastructure. Security teams should immediately block 185.246.190.216 and flag v.gettrustpayment.live at network and endpoint levels. Users should avoid interacting with this domain entirely and verify all payment processor communications through official channels. This threat highlights the growing sophistication of crypto drainer campaigns that bypass traditional detection mechanisms. Remaining risk is assessed as high due to its active status and current lack of vendor detection.