tronapp[.]net

This domain, tronapp.net, was registered on December 14, 2025, through Tucows Domains Inc., and as of the report date of July 23, 2026, has been taken offline. Analysis indicates this was a wallet or seed phrase phishing operation that impersonated the Binance brand, a common tactic to steal cryptocurrency credentials. The domain resolved to the IP address 104.21.8.220, hosted in the United States by Cloudflare (AS13335), and used Cloudflare's nameservers (armando.ns.cloudflare.com and keira.ns.cloudflare.com). The site employed an SSL certificate from Google Trust Services (WE1) and was served over HTTP/3.

When active, the page title was 'TronEnergy - Buy TRON Energy, Rent TRX Energy, Swap TRX USDT | Save 90%', suggesting the phishing lure was framed around a TRON network energy rental service to appear legitimate. The HTTP status returned 403, indicating restricted access at the time of analysis. Security vendor detection was significant, with 6 out of 95 antivirus engines on VirusTotal flagging the domain as malicious. It appeared on one security blocklist and was blocked by PhishDestroy.

The Gridinsoft trust score was 0 out of 100, confirming a high-risk classification. Defenders should note that while the domain is currently offline, the infrastructure—particularly the Cloudflare hosting and the registered nameservers—may be reused for future campaigns. Organizations targeting Binance users or individuals involved with TRON-based services should monitor for similar domain registrations and block communications referencing tronapp.net or related subdomains. The exact page content beyond the title has not been analysed, so the specific phishing delivery mechanism (e.g., fake login form, seed phrase prompt) remains unconfirmed.