trustwallet[.]com-two-factor-authentication06[.]ej[.]grsudq[.]com

This domain, trustwallet.com-two-factor-authentication06.ej.grsudq.com, is flagged as a high-risk crypto drainer targeting cryptocurrency wallet users. Analysis indicates the threat actor is impersonating a two-factor authentication page for Trust Wallet, a known cryptocurrency wallet brand, to trick victims into connecting their wallets. The infrastructure appears to be part of a drainer kit, designed to automatically siphon funds once a victim authorizes a malicious transaction. No specific drainer kit variant has been attributed at this time, but the domain structure and page title suggest a generic kit deployment. Infrastructure analysis reveals the following technical indicators: the domain is registered through IONOS SE and resolves to IP address 194.164.164.251. VirusTotal detections stand at 9/95 security vendors, indicating moderate confidence in malicious classification. The domain was created on May 23, 2026, which is anomalous given the future date, suggesting potential WHOIS manipulation or a placeholder record. Google Safe Browsing (GSB) status is not provided, but the domain is present on multiple blocklists, with at least 12 independent sources confirming malicious activity. The page title 'Index of /' further suggests an exposed directory listing, likely unintentional and indicative of poor operational security by the threat actor. The domain remains active as of the latest verification, posing an ongoing risk to users who may encounter it through phishing campaigns or malvertising. Recommended response actions include immediate blocking of the domain and associated IP at the network perimeter, as well as monitoring for wallet connection attempts from internal assets. Users should be advised to verify domain authenticity before entering credentials or connecting wallets, particularly for cryptocurrency-related services. Despite existing detections, the domain's active status and high-risk classification warrant continued vigilance, as threat actors may pivot infrastructure or deploy new variants to evade defenses.