trustwallet[.]com-two-factor-authentication08[.]ao[.]yesixrq[.]com

Analysis indicates that the domain trustwallet.com-two-factor-authentication08.ao.yesixrq.com is an active crypto-drainer infrastructure registered on June 13, 2026, through IONOS SE. The domain is currently resolving to IP address 77.68.5.178 and uses nameservers ns1.sslwhm.online and ns2.sslwhm.online. As of July 20, 2026, this domain appears on three security blocklists, including PhishDestroy, OpenPhish, and Phishunt, and is flagged by 19 of 91 security vendors on VirusTotal. The threat type is classified as a high-risk crypto drainer, suggesting its use in targeting cryptocurrency wallet credentials to facilitate unauthorized fund transfers. No specific brand impersonation details or phishing kit identifiers are available at this time, and the exact content of the site remains unanalyzed. Defenders should treat this domain as malicious and prioritize blocking it at the DNS and network levels. Organizations are advised to monitor for connections to 77.68.5.178 and review logs for interactions with the yesixrq.com subdomain structure, which may indicate compromise attempts. Given its active status and detection by multiple security sources, this domain poses a credible and immediate threat to users of cryptocurrency platforms.