# PhishDestroy threat dossier — tronnrg.com ================================================================ Fetched: 2026-04-23 13:30:17 UTC Canonical: https://phishdestroy.io/domain/tronnrg.com/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: status_split) (score: 1/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/94 security vendors flagged this domain ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 64.29.17.65 (US, Walnut) ASN: AS16509 Amazon.com, Inc. Hosting org: Vercel, Inc Registrar: GoDaddy.com, LLC Nameservers: ["ns1.vercel-dns.com", "ns2.vercel-dns.com"] Registered: 2026-04-18 Page title: Rent Tron Energy: Send USDT for 4 TRX Instead of 13 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R13 Expires: 2026-06-15 Status: INVALID chain Fingerprint: 66fb98497144c9b86643ea6653cf3d7ec8c9ce124895960245818c19b4d099f4 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-18 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-18 21:04:55 UTC (by PhishDestroy tracker) Earliest abuse rec: 2026-04-18 18:06:55 UTC — PREDATES current WHOIS registration; retained from a previous registration cycle of the same domain name Last verified: 2026-04-23 07:40:19 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners Note: one or more events above predate the WHOIS creation date. This typically means the same domain name was previously registered, detected, dropped, and then re-registered by a new party. PhishDestroy preserves the full historical record for operator-attribution research even when the underlying infrastructure changes hands. ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019da1c2-9e6e-7591-826c-ad40a9b8df40/ URLQuery: https://urlquery.net/report/6e6fee8f-17aa-4bfe-bfe0-8ad37f88b81e Wayback Machine: https://web.archive.org/web/*/tronnrg.com crt.sh CT logs: https://crt.sh/?q=%25.tronnrg.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=tronnrg.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/tronnrg.com URLhaus: https://urlhaus.abuse.ch/host/tronnrg.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-18 21:06:04 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies tronnrg.com as a newly active fake energy bill phishing domain designed to trick users into entering sensitive financial or personal information under the guise of an energy bill payment portal. This site mimics legitimate utility billing interfaces to harvest credentials or payment details, posing a direct risk to users who interact with it. The domain's recent creation and low detection rate make it particularly dangerous, as it may evade immediate scrutiny by both users and automated security tools. This domain was flagged by PhishDestroy with 0 detections out of 95 VirusTotal scans, indicating it has not yet been widely recognized as malicious. tronnrg.com was registered on May 24, 2022, through GoDaddy.com, LLC, and resolves to the IP address 64.29.17.65. It utilizes a Let's Encrypt SSL certificate, which may lend it an air of legitimacy at first glance. The combination of recent registration, low detection rate, and active hosting suggests this site is part of a targeted phishing campaign, likely aimed at unsuspecting users expecting to pay utility bills. If you visited tronnrg.com, avoid entering any personal or financial information, as it could be captured by attackers. Disconnect from the site immediately and consider running a malware scan on your device. Report the domain to your email provider or browser to help block future access. Monitor your financial accounts for unusual activity, as compromised payment details could lead to fraudulent transactions. For a deeper analysis, review the full PhishDestroy report to understand the specific tactics used by this scam site. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260418-03F456 Favicon MD5: 94b56a3359273ae0a92f7889f3667b63 TLS cert SHA-256: 66fb98497144c9b86643ea6653cf3d7ec8c9ce124895960245818c19b4d099f4 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/tronnrg.com/ JSON API: https://api.destroy.tools/v1/check?domain=tronnrg.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io