tronscan[.]space

On July 23, 2026, the domain tronscan.space was observed to be offline but remains listed in multiple threat feeds. The domain was registered on November 10, 2025 through NameCheap, Inc. and resolves to the IP address 185.199.110.153, which belongs to Fastly, Inc. (AS54113) in the United States. The TLS certificate presented is identified as R13, indicating a recent issuance without extended validation. The site’s HTML title reports “TRONSCAN - TRON Blockchain Explorer,” yet the domain is flagged for impersonating the financial‑technology brand justlend, a mismatch that suggests a deliberate brand‑spoofing attempt aimed at crypto‑related victims. Reputation services assign a Gridinsoft trust score of 0 out of 100, reflecting an extremely low confidence rating.

The domain appears on three independent security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the perception of malicious intent. VirusTotal analysis shows that 16 of 93 scanning engines flagged the domain, indicating a moderate consensus of malicious behavior. AlienVault’s Open Threat Exchange records the domain in one threat‑intel pulse, providing additional community corroboration. The classification “Crypto Scam” aligns with the observed impersonation of justlend, a platform that processes loans and may be targeted for credential harvesting or fund diversion. However, the offline HTTP status prevents direct verification of the payload or phishing page content; no visual or functional details are available beyond the page title.

Consequently, the exact tactics, techniques, and procedures (TTPs) employed by the operators remain uncertain. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurrection of the host, and incorporate the IP address 185.199.110.153 into threat‑intel feeds. Given the association with Fastly’s CDN, rapid changes to hosting could occur, so periodic re‑resolution is advised.