tronwallet[.]live

PhishDestroy identifies tronwallet.live as a confirmed crypto drainer impersonating the official Tron Wallet service. This domain was flagged as active on April 18, 2026, with a Let's Encrypt SSL certificate and resolving to IP 104.21.25.16. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for accommodating high-risk or malicious registrations. Current VirusTotal analysis shows zero detections out of 95 engines, indicating it has evaded automated detection systems thus far. Technical indicators and risk assessment for this domain reveal a high-risk profile despite its low detection rate. The domain's recent creation (April 2026) suggests opportunistic deployment to capitalize on emerging Tron Wallet users or campaigns. The use of Let's Encrypt for SSL certificates adds a veneer of legitimacy, while the hosting IP (104.21.25.16) is associated with multiple high-risk domains in historical datasets. The zero-detection status on VirusTotal underscores the sophistication of this threat, which likely employs dynamic evasion techniques to bypass signature-based detection. Given the domain’s active status and the specific targeting of cryptocurrency wallets, the risk level is classified as critical for users interacting with Tron-related services. Users who have visited tronwallet.live should immediately check their cryptocurrency wallets for unauthorized transactions or drained funds, as crypto drainers like this one are designed to silently transfer assets to attacker-controlled wallets. If any interaction occurred, such as entering credentials or connecting a wallet, revoke permissions for connected apps in your wallet settings and transfer remaining funds to a cold storage solution. Report the domain to your antivirus provider and consider using a dedicated phishing blocklist like PhishDestroy to prevent future exposure. Monitor financial accounts closely for anomalous activity and enable multi-factor authentication (MFA) on all crypto-related services.