troncamp[.]io

Analysis indicates that the domain troncamp.io was registered on February 21, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. The site returns an HTTP 403 status and presents the page title “Just a moment…”. Intelligence classifies the activity as a crypto scam under the generic_phishing threat type, and the domain appears on three security blocklists. It has also been referenced in a single AlienVault OTX pulse. Infrastructure analysis shows the domain resolves to IP address 188.114.96.3, which is located in the United States and belongs to AS13335 Cloudflare, Inc. The name servers roxy.ns.cloudflare.com and ganz.ns.cloudflare.com confirm the use of Cloudflare’s network. Detected technologies include Cloudflare Browser Insights, Cloudflare, and HTTP/3. The SSL certificate is issued by Google Trust Services under the WE1 designation. Risk assessment is heightened by a Gridinsoft trust score of 1 out of 100 and a VirusTotal rating where 4 of 95 security vendors flag the domain. The domain is blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the high‑risk classification. The combination of a low trust score, multiple vendor detections, and active blocklist entries aligns with the high‑risk level assigned. Defenders should prioritize immediate blocking of troncamp.io at perimeter and DNS filtering layers, and consider adding the associated IP 188.114.96.3 to any existing deny lists. Continuous monitoring of the registrar NICENIC INTERNATIONAL GROUP CO., LIMITED for future registrations may provide early warning of related infrastructure. Because the site leverages Cloudflare’s CDN, traffic inspection may require TLS interception or proxy solutions capable of decrypting HTTPS sessions. Organizations should also update internal threat intelligence feeds with the observed indicators to improve detection of similar crypto‑focused phishing campaigns.