gosun-io-ui-1a91f6f8[.]pages[.]dev

gosun-io-ui-1a91f6f8.pages.dev is currently active and leveraging a generic phishing campaign to impersonate GoSun.io, a known enterprise USDT transfer platform operating on the TRON network. The malicious domain specifically targets users through a fake login portal designed to siphon cryptocurrency assets via TRON-based drainer scripts. PhishDestroy identifies this as a high-risk threat under active exploitation, with no detections recorded on VirusTotal as of the latest scan.

This domain was flagged by 0 out of 95 VirusTotal security vendors, indicating a lack of widespread recognition despite its active status. The domain is registered through Cloudflare, Inc., resolving to IP address 172.66.44.128 and secured with a Google Trust Services SSL certificate. The page title and branding closely mimic the legitimate GoSun.io platform, which focuses on TRON energy aggregation and enterprise USDT transfers. Current intelligence suggests the domain remains unresolved by major blocklists, maintaining a clean reputation score across threat intelligence platforms.

Given the absence of VirusTotal detections and minimal third-party scrutiny, users are strongly advised to treat this domain with extreme caution. The threat appears to be a recently deployed crypto drainer campaign, specifically targeting TRON-based transactions. Users should verify the legitimacy of any GoSun.io-related links using PhishDestroy’s real-time verification tools. Additionally, enterprises and individuals transacting in USDT on the TRON network are urged to cross-reference URLs against official GoSun.io domains and enable transaction confirmation prompts for all outgoing transfers.