trxdrop[.]live

This domain, trxdrop.live, was registered on 21 February 2026 through Web Commerce Communications Limited and resolves to the Cloudflare address 188.114.96.3, which is announced as belonging to AS13335 Cloudflare, Inc. in the United States. The site does not present an SSL/TLS certificate, indicating that any communication with the host occurs over plain HTTP. The page title returned by the server is “TRON Worker Panel”, and the domain explicitly impersonates the cryptocurrency brand Tron, categorised as a crypto‑scam. Analysis on VirusTotal shows that four of ninety‑three scanning engines have raised detections for the domain, and the domain appears on a single external blocklist where it is listed as blocked by PhishDestroy.

The authoritative nameservers are alice.ns.cloudflare.com and george.ns.cloudflare.com, both belonging to the Cloudflare DNS service. AlienVault OTX references the domain in one threat‑intelligence pulse, further corroborating its malicious reputation. The current status is active as of the report date 23 July 2026, and the infrastructure remains unchanged since registration.

While the limited number of detections and blocklist entries suggest that the campaign may be in early stages, the combination of brand impersonation, lack of encryption, and confirmed malicious indicators warrants immediate defensive actions. Organizations should add 188.114.96.3 to network deny lists, enforce TLS inspection on outbound traffic to detect clear‑text HTTP to this host, and ensure that any endpoint or web‑gateway solutions block the domain name and its associated IP. Continuous monitoring of the two Cloudflare nameservers for new sub‑domains or DNS changes is advised, as well as periodic re‑scanning on multi‑engine services to capture any evolution of the threat profile.