# PhishDestroy threat dossier — tronmotion3d.com ================================================================ Fetched: 2026-05-07 17:36:42 UTC Canonical: https://phishdestroy.io/domain/tronmotion3d.com/ ## VERDICT ---------------------------------------------------------------- HIGH THREAT — malicious activity confirmed Composite threat score: 60/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/95 security vendors flagged this domain ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 185.230.63.171 (US, Ashburn) ASN: AS58182 Wix.com Ltd. Hosting org: Wix Com Inc Registrar: Wix.com Ltd. Nameservers: ns14.wixdns.net, ns15.wixdns.net Registered: 2026-04-22 Page title: 魔創3D | TronMotion HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WR1 Expires: 2026-07-21 Status: INVALID chain Fingerprint: d53a0f0619f1229973c1209be8b6d92545416bbdb33a81a10de9943a0e2a8383 Subject Alternative Names (related infrastructure — often same operator): - www.tronmotion3d.com ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-22 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-07 09:45:06 UTC (by PhishDestroy tracker) Last verified: 2026-05-07 18:09:18 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019e012b-1310-7382-bc65-7cc192947009/ Wayback Machine: https://web.archive.org/web/*/tronmotion3d.com crt.sh CT logs: https://crt.sh/?q=%25.tronmotion3d.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=tronmotion3d.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/tronmotion3d.com URLhaus: https://urlhaus.abuse.ch/host/tronmotion3d.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-07 09:47:52 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies tronmotion3d.com as a recently activated domain suspected of distributing counterfeit 3D model files to harvest user credentials or install malware. This site poses an immediate risk to individuals and businesses searching for design assets, as its operators may replace legitimate downloads with malicious payloads designed to steal sensitive information or compromise systems. The threat is particularly insidious because the domain appears professionally hosted via Wix.com Ltd., leveraging a Google Trust Services SSL certificate to mimic legitimacy. With zero detections on VirusTotal out of 95 security engines as of the investigation seed f882b5, this domain remains under active monitoring, but users should treat it with extreme caution. This domain was flagged during routine surveillance after being registered on April 22, 2026, and resolving to IP address 185.230.63.171. The creation date is suspiciously recent, coinciding with a surge in fake 3D asset repositories circulating in design communities. While the registrar is Wix.com Ltd., a common web hosting platform, the absence of detection does not imply safety—many phishing campaigns bypass initial scans by evolving content or redirecting users through benign-looking interfaces. The technical indicators, including the SSL certificate issued by Google Trust Services, are designed to build false trust, but the domain’s age and detection history suggest it is likely a newly deployed scam. If you have visited tronmotion3d.com, do not download any files or input personal information. Disconnect from the site immediately and run a full antivirus scan on your device. Clear your browser cache and change passwords for accounts accessed from the same network, especially if you entered credentials on the site. Report the domain to your IT administrator or security team, and file a complaint with your national cybercrime unit or platform provider (e.g., Wix abuse channel). Monitor your accounts for unusual activity and consider using a credit monitoring service if financial data was exposed. Stay vigilant—new phishing domains emerge daily, and even professionally hosted sites can be weaponized within hours of creation. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: b53ce85a6cce2ae00037a6ca13c90866 TLS cert SHA-256: d53a0f0619f1229973c1209be8b6d92545416bbdb33a81a10de9943a0e2a8383 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/tronmotion3d.com/ JSON API: https://api.destroy.tools/v1/check?domain=tronmotion3d.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 146,953 domains (52,956 alive under monitoring, 93,722 confirmed takedowns/dead). Site: https://phishdestroy.io