As of July 31, 2026, the domain trustwalletplus.com is flagged as a potential crypto drainer. The domain was registered on July 28, 2026, and is currently active, indicating recent and ongoing malicious activity. Infrastructure analysis reveals that the domain resolves to the IP address 23.227.38.36. The nameservers used are ns-cloud-d1.googledomains.com, ns-cloud-d2.googledomains.com, and ns-cloud-d3.googledomains.com, which are managed by Google.
The domain is registered through TUCOWS.COM, CO., a known registrar. While VirusTotal has scanned the domain with 91 vendors, none currently flag it as malicious; however, this absence of detections does not guarantee the domain's safety. The domain appears on two security blocklists, specifically PhishDestroy and SEAL, which suggests a higher risk of being involved in phishing or other malicious activities.
Defenders should treat this domain with caution and consider blocking it to prevent potential crypto drainer attacks. Additional monitoring and analysis are recommended to gather more evidence and confirm the nature of the threat. The exact content of the domain has not yet been analyzed, but the combination of its recent registration and presence on blocklists warrants immediate attention.