trojanbot[.]work

This domain is flagged as a high-risk crypto drainer phishing site designed to compromise digital asset wallets. Analysis indicates it specifically targets users through deceptive maximum extractable value (MEV) bot schemes, as evidenced by the page title 'TrojanBot — #1 MEV.' The infrastructure and content suggest an intent to trick victims into connecting wallets, enabling unauthorized transactions that drain funds. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain was registered on July 16, 2025, through GoDaddy.com, LLC, and resolves to the IP address 186.2.175.35. It is detected by 15 out of 95 security vendors on VirusTotal, appears on three security blocklists, and is referenced in two AlienVault OTX threat intelligence pulses. The site was hosted behind DDoS-Guard, a service frequently associated with malicious infrastructure, and used a Let's Encrypt SSL certificate. Additional detections include blocking by MetaMask, PhishDestroy, and SEAL, alongside a Gridinsoft trust score of 0/100. The domain is currently offline, though historical activity remains a concern. Users who may have interacted with trojanbot.work should immediately revoke any wallet connections and transfer remaining assets to a new, secure wallet. Monitor transaction histories for unauthorized activity and report the domain to relevant security platforms. Avoid engaging with any communications or links associated with MEV bot offers, particularly those promising high returns or requiring wallet access. Security teams should update blocklists to include this domain and its associated IP to prevent future exposure.