justmoney[.]shop

This domain, justmoney.shop, is flagged as a crypto drainer impersonating the JustMoney Cross-Chain Swap service for the Tron blockchain. Analysis indicates the site is designed to deceive users into connecting wallets, subsequently draining funds through malicious smart contract interactions. The threat specifically targets cryptocurrency holders seeking cross-chain swap functionality, exploiting trust in legitimate Tron-based platforms. Evidence supporting this assessment includes a VirusTotal detection ratio of 2/95 security vendors, indicating limited but confirmed malicious classification. Infrastructure analysis reveals the domain resolves to IP address 186.2.175.35, hosted on infrastructure previously associated with fraudulent financial services. The domain was registered through a privacy-protected registrar, obscuring ownership details, and currently remains active with no blocklist entries beyond the VirusTotal detections. The page title explicitly references 'JustMoney Cross-Chain Swap - Tron,' further confirming the impersonation vector. Users who visited justmoney.shop and connected a wallet or entered credentials should immediately revoke all active smart contract approvals using a blockchain explorer or wallet security tool. Disconnect any linked wallets from the site and transfer assets to a new, secure wallet address. Scan the device used for access with updated security software to detect potential malware. Monitor transaction histories for unauthorized activity and report the domain to relevant blockchain security platforms for further mitigation. If funds were transferred, document all transaction hashes and contact the receiving exchange or wallet provider to attempt recovery.