trondrop[.]io

This domain, trondrop.io, is actively engaged in cryptocurrency phishing operations targeting users of the Across protocol. Registered on February 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the site presents itself as a TRON airdrop scanner and Web3 analytics platform under the title 'TronDrop.io — TRON Airdrop Scanner & Web3 Analytics.' Infrastructure analysis reveals the domain is hosted behind Cloudflare (AS13335) at IP address 172.67.223.201, with nameservers cash.ns.cloudflare.com and irena.ns.cloudflare.com, and an SSL certificate issued by Google Trust Services. The site returns a 200 HTTP status, indicating full operational capacity as of July 12, 2026. The technical indicators strongly support classification as a seed-phishing and wallet-connect phishing site. It is explicitly blocked by multiple security entities, including PhishDestroy, MetaMask, and SEAL, and holds a Gridinsoft trust score of 0/100. Two of 95 security vendors on VirusTotal have flagged the domain, while it appears on three independent blocklists. Detected technologies include Unpkg, jsDelivr, Cloudflare Browser Insights, and Axios, suggesting the use of a modular phishing kit designed for rapid deployment and data exfiltration. The domain’s creation date and infrastructure setup align with known patterns of airdrop scams targeting decentralized finance users. While the site remains accessible, its fraudulent intent is corroborated by its impersonation of the Across brand and the presence of wallet-drain mechanisms. Defenders should treat this domain as a high-risk asset and prioritize blocking at the DNS, network, and endpoint levels. The use of Cloudflare complicates takedown efforts, but monitoring for associated IP shifts or certificate changes may aid in tracking the threat actor’s infrastructure. No legitimate business or technical justification exists for this domain’s current configuration or content.