tromscan[.]webflow[.]io

This domain is flagged as under investigation for generic phishing activity, specifically involving brand impersonation attempting to mimic the TRONSCAN service. The risk level is currently under investigation, and the domain has been taken offline. The use of an official-sounding page title, 'TRONSCAN™ | Home Official Site,' indicates an attempt to deceive users into believing the site is connected to a legitimate crypto brand, raising concerns for potential credential harvesting or wallet draining attacks.

Infrastructure and threat intelligence analysis reveal several key technical indicators. The domain tromscan.webflow.io resolves to IP address 172.64.151.8 and was initially created on May 08, 2013, registered through MarkMonitor, Inc. VirusTotal analysis yields 0/95 detections, indicating no current engine flagging, but the domain appears on one prominent security blocklist and is blocked by at least one threat intelligence provider. Technologies detected include Cloudflare and HTTP/3, with an SSL certificate issued by Google Trust Services. While currently offline, its inclusion in blocklists and use of brand impersonation tactics warrant continued monitoring.

Recommended mitigation steps include immediate blocking of tromscan.webflow.io at the network and endpoint levels. Users should be informed of the impersonation risk, especially those involved in cryptocurrency transactions. Incident response teams are advised to monitor for variants or related domains leveraging similar infrastructure or naming patterns. All credentials or sensitive information previously submitted to this domain should be treated as compromised, and password resets or wallet security checks should be initiated as appropriate.