tronlink-web3[.]web[.]app

The domain tronlink-web3.web.app was registered on April 17, 2026 through Google LLC. DNS resolution returns the single IPv4 address 199.36.158.100, which is hosted in the United States and owned by Google LLC. The site serves over HTTPS using a certificate issued by Google Trust Services under the WR4 profile, and the connection is protected by HSTS and HTTP/3. A visual inspection of the landing page reveals the title “ΤrоnLіnk - Web3 Wallet”, mimicking the legitimate TronLink wallet interface. The page is built on Firebase, indicating the use of Google’s serverless hosting platform. HTTP responses return status code 200, confirming that the content is actively served. The indicator has been added to one external blocklist and is currently blocked by PhishDestroy. VirusTotal has not generated any detections (0/95), and the Gridinsoft trust score is 0/100, reflecting a lack of reputation. No additional nameservers were identified (NS_NOT_FOUND), and no further sub‑domains or C2 infrastructure have been observed. The limited data set leaves open the possibility of future expansion, but the present evidence aligns with a generic phishing campaign targeting users of the TronLink wallet. Defenders should treat the domain as malicious and enforce network‑level denial of traffic to 199.36.158.100 when the host header matches tronlink‑web3.web.app. Email gateways and web proxies should add the domain to blocklists and enable content‑filtering rules for the “TronLink” brand. Continuous monitoring of the IP address and any newly resolved hosts in the same CIDR is advised, as attackers often pivot to adjacent resources. Incident response teams should also educate end users about the spoofed page title and the risk of credential harvesting.