connect-wallet-web3[.]com

This domain, connect-wallet-web3.com, is actively impersonating the Tron blockchain network as part of a cryptocurrency drainer operation. Registered on February 21, 2026, through Gname.com Pte. Ltd., the domain currently resolves to 74.208.152.141, hosted on AS8560 (IONOS SE) in the United States. The page title explicitly reads 'Tron Drainer,' confirming its intended function as a wallet-draining tool targeting Tron users. Analysis indicates the domain lacks an SSL certificate, a common but not definitive indicator of malicious intent, particularly in phishing or scam infrastructure. Infrastructure analysis reveals the domain uses Cloudflare nameservers (elliott.ns.cloudflare.com and meg.ns.cloudflare.com), a frequent choice for threat actors seeking to obscure hosting details and evade takedowns. As of July 12, 2026, the domain remains active with an HTTP 200 status, signaling operational readiness. Security vendor detection is limited but notable: 3 out of 95 engines on VirusTotal flag the domain, while four independent blocklists—including PhishDestroy, Polkadot, Enkrypt, and Codeesura—have listed it as malicious. The Gridinsoft trust score of 0/100 further supports its classification as high-risk. The threat actor’s methodology aligns with known cryptocurrency drainer campaigns, where victims are tricked into connecting wallets to malicious smart contracts or fake interfaces. While the exact drainer kit or payload remains unconfirmed, the domain’s branding and naming conventions strongly suggest it is part of a broader, active campaign targeting Tron users. Defenders should prioritize blocking the domain and its resolving IP at the network level. Monitoring for associated wallet addresses or smart contract interactions is recommended, as these may provide additional indicators for tracking the threat actor’s financial infrastructure. No legitimate use case for this domain has been identified.