gas789[.]top

The domain gas789.top is a confirmed phishing site engaged in brand impersonation targeting the cryptocurrency platform Tron. It presented itself as a 'TRX energy rental' service, falsely offering free conversions between TRX and other tokens to deceive users into disclosing wallet credentials or transferring funds. No crypto drainer kit was identified, but the site posed an elevated risk due to its fraudulent representation of Tron. As of the latest verification, gas789.top has been taken offline.

Technical indicators confirm the malicious nature of gas789.top. The domain was flagged by 2 of 95 security vendors on VirusTotal, including Criminal IP and alphaMountain.ai. It appeared on 2 security blocklists, PhishDestroy and ScamSniffer, and received a Gridinsoft trust score of 0/100. Registered through NameSilo, LLC on October 27, 2025, the domain resolved to the IP address 104.21.74.229, hosted by Cloudflare in the US (AS13335). The site lacked an SSL certificate, and its nameservers were corey.ns.cloudflare.com and lauryn.ns.cloudflare.com. The observed page title was '波场巨鲸能量池(0.1TRX转U免费)TRX能量租赁'.

Users who interacted with gas789.top should immediately revoke any token approvals granted to the site and transfer remaining funds to a new, secure wallet. Monitor transaction histories for unauthorized activity and report any losses to the relevant cryptocurrency exchange or wallet provider. To prevent further exposure, enable two-factor authentication on all accounts and change passwords if credentials were entered. Report the phishing domain to platforms such as Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to assist in broader takedown efforts.