trons[.]app

Analysis of trons.app indicates a high‑risk credential‑phishing operation targeting Google users. The domain was registered on July 11, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED and currently resolves to the IPv4 address 172.217.16.196, which belongs to AS15169 Google LLC and is geolocated in Germany. The site presents the page title "Google," directly aligning with the declared brand target of Google. Its SSL certificate is identified as WE1, and the domain has been assigned a Gridinsoft trust score of 0 out of 100, reflecting an extremely low reputation.

The infrastructure has been listed on four security blocklists; specifically, it is blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. VirusTotal analysis shows that ten of ninety‑three scanning engines flag the domain as malicious, reinforcing the suspicion of phishing activity. The campaign is classified as credential phishing, and the impersonated brand is explicitly Google.

At the time of reporting (July 25, 2026) the site is offline, limiting immediate interaction but confirming that the infrastructure was previously active. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑hosting attempts, and update endpoint protection signatures to include the observed SSL fingerprint and IP address. Analysts should also watch for related domains registered by the same registrar, as the low trust score and blocklist presence suggest a broader malicious infrastructure that may be leveraged in future campaigns.