tronly[.]app

The domain tronly.app is currently under investigation for generic phishing activity specifically targeting users of the TRON blockchain network. Analysis of the page title, "Tronly — Swap USDT to TRX with No TRX Required | TRC20 Gas Fix," indicates an attempt to impersonate legitimate TRON-based swap services by offering a fraudulent solution for converting USDT to TRX without requiring TRX for gas fees. This domain remains active and has not yet been widely flagged by security vendors, though its infrastructure and claims warrant closer scrutiny. Infrastructure analysis reveals that tronly.app resolves to the IP address 172.67.195.128 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 20, 2026. Despite its recent creation date, the domain has already been included in one security blocklist. VirusTotal reports zero detections out of 95 vendors, suggesting limited visibility or evasion of current detection mechanisms. The domain was also referenced in one AlienVault OTX threat intelligence pulse, indicating early-stage awareness within the security community. Current risk assessment places tronly.app in an ambiguous state due to its low detection rate but suspicious thematic content and infrastructure. Users are advised to exercise extreme caution when interacting with this domain, particularly if prompted to connect wallets or input sensitive information. Security teams should monitor the domain for changes in detection status and consider blocking access to 172.67.195.128 as a precautionary measure. Given the domain's focus on TRON-based transactions, users should verify the legitimacy of any swap service through official TRON channels before proceeding with any financial operations.