trontradinghub[.]org

On July 22, 2026, investigative analysis focused on the domain trontradinghub.org, which is actively hosting a Google brand‑impersonation campaign. The site presents the page title “TRON TRADING HUB‑ Home” and returns HTTP 200 over a LiteSpeed server that also supports HTTP/3. The TLS certificate is issued by Let’s Encrypt (E8), confirming that encryption is in place but offering no validation of the operator. DNS resolution points to the address 152.89.62.200, which belongs to Autonomous System AS30860 operated by Virtual Systems LLC and is geolocated to Ukraine.

The domain was registered on 21 February 2026 through Dynadot LLC, and its authoritative name servers are ns1.geebytescloud.com and ns2.geebytescloud.com. Reputation checks show a Gridinsoft trust score of 1 / 100, indicating extreme risk, and five of ninety‑five VirusTotal scanners have flagged the domain as malicious. It appears on at least one security blocklist and is currently blocked by PhishDestroy.

The observed infrastructure aligns with a “Fake Exchange” scam type, although the specific page content has not been captured. Given the confirmed impersonation of Google, the active status, and the low trust rating, defenders should add trontradinghub.org to URL filtering and DNS‑sinkhole policies, monitor outbound connections to the associated IP, and flag any traffic that attempts to negotiate TLS with the Let’s Encrypt certificate. Continuous re‑scanning of the domain with multi‑engine services is advised to detect any changes in payload or additional malicious indicators.