trobhonm[.]com

Analysis of trobhonm.com shows a short‑lived infrastructure that was taken offline shortly after detection. The domain was registered on April 27, 2026 through NameSilo, LLC and resolves to the IP address 193.24.123.240, which is assigned to a Russian hosting entity identified as Prospero OOO. DNS resolution uses the ns1.dnsowl.com, ns2.dnsowl.com, and ns3.dnsowl.com name servers, a configuration commonly observed in malicious deployments. The site served content over HTTPS using a Let’s Encrypt certificate (issuer E7) and advertised HTTP Strict Transport Security, indicating an attempt to appear legitimate. Technical fingerprinting revealed a stack comprising Node.js, React, Next.js, Nginx, Webpack, and HSTS, all typical of modern web applications but also frequently leveraged by phishing operators to host dynamic credential‑stealing pages.

The page title returned by the server is "AlphaTetherLink," a string that provides no direct indication of the targeted brand or service. Threat intelligence sources have placed the domain on three public blocklists and it is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans returned four positive detections out of ninety‑one submitted engines, reinforcing the malicious assessment. Independent scoring from Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating. The domain’s current status is offline, limiting immediate probing but preserving forensic artifacts.

Uncertainties remain regarding the exact phishing campaign payload, the specific victim vector, and whether any credential data was harvested before takedown. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the associated IP or name‑server patterns, and consider sharing the indicator set with threat‑sharing communities.