go[.]tronfinance[.]org

Analysis of go.tronfinance.org indicates a high‑risk brand‑impersonation campaign targeting Google users. The domain was registered on March 27, 2026 through Namecheap Inc. and presently resolves to the IP address 142.251.155.119, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Authoritative name servers eugene.ns.cloudflare.com and jillian.ns.cloudflare.com are in use, and the site presents a valid TLS certificate issued by Google Trust Services, suggesting the TLS handshake is legitimate despite the malicious intent.

The public‑facing page advertises “Tron Wallet Guard – Apps on Google Play,” a title that mimics a legitimate Google Play listing while the underlying content is designed to deceive visitors into disclosing Google credentials. Infrastructure fingerprints reveal the presence of Unpkg and HTTP/3, both delivered through Cloudflare’s edge network, which further obscures the origin of any payload. No additional hosting or C2 infrastructure has been identified beyond the Cloudflare front‑end, leaving the ultimate command and control location uncertain.

Detection metrics show the domain appearing on a single security blocklist and being flagged by three of ninety‑five VirusTotal scanners. PhishDestroy has already added the domain to its blocklist, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the assessment of malicious intent. The HTTP response code is 200, indicating the site is actively serving content at the time of analysis.

Defenders should immediately block DNS resolution for go.tronfinance.org and enforce URL filtering to prevent user access. Continuous monitoring of Cloudflare‑hosted IP ranges for similar impersonation patterns is advised, as the attacker may reuse the same edge infrastructure for future campaigns. Incident response teams should treat any credential submissions to this domain as compromised and initiate credential rotation for affected Google accounts.