m[.]trustwalletiat[.]com

PhishDestroy has identified an active cryptocurrency drainer impersonating Trust Wallet. The malicious domain m.trustwalletiat.com poses an elevated risk due to its convincing impersonation tactics and confirmed malicious activity, including crypto token draining operations.

This domain was flagged by 8 out of 95 security vendors on VirusTotal, with the first submission occurring shortly after its creation. It resolves to IP 47.80.68.7 and was registered through Gname.com Pte. Ltd. on October 24, 2025. The site appears on two prominent security blocklists and has been specifically blocked by MetaMask and SEAL security extensions. Despite using a legitimate Let's Encrypt SSL certificate, the domain's Chinese page title (网站筹建中) and redirection patterns reveal its malicious intent. Its recent registration date suggests a likely opportunistic campaign targeting cryptocurrency users.

Cryptocurrency users must exercise extreme caution with this domain. The presence of a drainer script on such impersonation pages typically executes unauthorized token transfers once wallet connections are established. Immediately block this domain at your network level and verify any Trust Wallet-related URLs through PhishDestroy's verification system before interacting. Consider adding the domain to your browser's blocklist and report any suspicious activity to Trust Wallet's official security channels. Never enter private keys or seed phrases on sites claiming to be Trust Wallet without verifying the URL through multiple independent sources.