trondefi[.]fun

The domain trondefi.fun was created on July 17, 2026 and is currently active. Registration information shows it was filed through Fewmoretaps OU doing business as Trustname.com. The domain is delegated to four nameservers – ares.trustname.com, zeus.trustname.com, ns1.anycastdns.cz and ns2.anycastdns.cz – and resolves to the IPv4 address 186.2.175.35. VirusTotal has recorded a scan performed by 91 antivirus and URL‑reputation vendors; at the time of analysis no vendor has flagged the domain, but the lack of detections is not evidence of benign intent.

The domain appears on a single external blocklist, identified by PhishDestroy, indicating that at least one security community has taken action to block it. The threat classification supplied is a crypto drainer, and the status is marked as active and under investigation. No additional data such as SSL certificate details, HTTP response codes, Safe Browsing verdicts, OTX tags, or page‑title information are present in the current intelligence set, leaving the exact malicious payload or delivery mechanism unconfirmed.

Defenders should treat the domain as hostile: block DNS resolution for trondefi.fun, add the IP 186.2.175.35 to network deny lists, and monitor for any future detections or changes in vendor reputation. Continuous re‑scanning with VirusTotal and other threat‑intel feeds is advised, as the absence of current detections may evolve. Logging of outbound connections to the listed nameservers and the IP address can provide early indicators if the infrastructure is leveraged in future campaigns.