trustwalletextension-auth[.]framer[.]ai

PhishDestroy identifies trustwalletextension-auth.framer.ai as an active crypto drainer impersonating the Trust Wallet brand. This domain leverages fraudulent authentication pages to deceive users into connecting crypto wallets, enabling unauthorized token and asset transfers. The site masquerades as a legitimate browser extension tied to Trust Wallet, exploiting user trust in a high-value cryptocurrency ecosystem where losses are irreversible. Given the domain's recent registration and lack of detection on VirusTotal, the threat remains under the radar but highly dangerous to crypto holders. Immediate action is required to prevent financial harm and protect brand reputation.

This domain was flagged by PhishDestroy with the following technical indicators: SSL certificate issued by Let's Encrypt, resolving to IP address 31.43.161.6. The domain shows 0 detections out of 95 analyzed engines on VirusTotal, indicating zero current recognition as malicious despite its deceptive nature. While exact registration or creation dates are not publicly disclosed via WHOIS at this time, the absence of blocklist entries suggests a newly deployed campaign. Trust scores are critically low due to impersonation of a major crypto brand, with no legitimate association to Trust Wallet’s official infrastructure (trustwallet.com). The use of a framer.ai subdomain further obfuscates the true origin, reinforcing its fraudulent intent.

To mitigate exposure to this crypto drainer, users must verify all browser extensions and web links before interaction. Trust Wallet users should only access extensions and services through the official website and official app store listings. Block the IP address 31.43.161.6 at the firewall or network level. Report the domain to Trust Wallet (support@trustwallet.com), browsers (via phishing report tools), and VirusTotal. Crypto users are advised to revoke any suspicious wallet connections immediately using tools like Revoke.cash. Always cross-check URLs for spelling variations or unusual subdomains. Stay vigilant—crypto drainers often evolve rapidly to evade detection.