tron-wallet[.]top

Analysis of the domain tron-wallet.top indicates active brand impersonation targeting Exodus, a cryptocurrency wallet service. The domain was registered on September 15, 2025, through Chengdu West Dimension Digital Technology Co., Ltd., a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to the IP address 34.130.222.18, which has been linked to prior phishing campaigns. The page title explicitly references 'exodus wallet,' aligning with the observed threat type of brand impersonation. Detection metrics reinforce the domain's malicious classification. As of July 12, 2026, the domain appears in 24 threat intelligence pulses on a major open-source threat exchange platform, suggesting widespread recognition of its malicious nature. It is currently flagged by at least two security blocklists and is actively blocked by multiple threat mitigation systems. A trust score assessment assigns the domain a rating of 0 out of 100, further corroborating its high-risk status. Thirteen of 95 security vendors on a widely used malware analysis platform have detected the domain as malicious, though the absence of detections from the remaining vendors does not imply benign status. The SSL certificate is issued by DigiCert Inc, a legitimate certificate authority, which may lend a superficial appearance of legitimacy but does not mitigate the underlying threat. The domain remains active as of the report date, with no evidence of takedown or remediation. Defenders are advised to treat this domain as hostile and prioritize blocking it at the network and endpoint levels. Additional monitoring of associated infrastructure, particularly the resolving IP address, is recommended to identify potential lateral movement or related malicious domains.