tron-swap[.]pages[.]dev

This domain, tron-swap.pages.dev, is flagged for brand impersonation targeting CoinGecko, a cryptocurrency data aggregator. Analysis indicates the site mimics legitimate swap portals, likely deploying a wallet-draining kit designed to siphon digital assets from victims. The page title, 'Tron Swap,' suggests a focus on Tron-based transactions, a common tactic to exploit users seeking token exchanges or liquidity opportunities. Infrastructure analysis reveals the domain was registered on July 29, 2025, through Cloudflare, Inc., and currently resolves to IP address 172.66.47.81, hosted on AS13335. VirusTotal detection shows 5 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a detail that may lend false legitimacy to the site. No Google Safe Browsing (GSB) flags are currently recorded. The domain remains active, posing a high risk to users who may unknowingly interact with it. Response actions include monitoring for further blocklist additions and tracking associated IP or certificate changes. Users are advised to verify domain authenticity via official CoinGecko channels before engaging in any transactions. The remaining risk is elevated due to the domain's persistence and the potential for financial loss through wallet-draining malware.