troncashout[.]com

Analysis of troncashout.com shows a newly created domain (creation date October 30 2025) that was actively used for a wallet‑seed phishing campaign targeting American Express customers. The site resolved to the IP address 188.114.96.3, which belongs to the Cloudflare network (AS13335) and is registered to a US location. Nameserver records point to luke.ns.cloudflare.com and simone.ns.cloudflare.com, confirming that the domain leveraged Cloudflare’s DNS and edge services. No SSL certificate was observed; the lack of HTTPS suggests the site was served over plain HTTP, a common characteristic of hastily deployed phishing infrastructure.

The page title captured by crawlers reads “USDT → Fiat • Instant Exchange,” indicating that the malicious page attempted to lure victims with a cryptocurrency exchange premise while simultaneously masquerading as an American Express communication. Gridinsoft assigned a trust score of 0 / 100, and VirusTotal recorded 16 detections out of 95 security vendors, confirming that multiple scanners flagged the domain as malicious. The domain appears on at least one public blocklist and was specifically blocked by the PhishDestroy service, reinforcing its reputation as a phishing vector. The registrar listed as Dominet (HK) Limited may be used to obscure ownership and facilitate rapid re‑registration if the domain is taken down.

Current status is offline, which may indicate takedown or temporary suspension. Uncertainties remain regarding the exact content served before the takedown, any additional payloads, and whether the infrastructure has been reused for other campaigns. Defenders should continue to monitor DNS resolutions for the IP 188.114.96.3 and associated Cloudflare nameservers, enforce email filtering rules that detect American Express branding combined with cryptocurrency terminology, and add the domain to internal blocklists.