tronfeel[.]net

Analysis indicates that the domain tronfeel.net was registered on 20 December 2025 through NiceNIC International Group Co., Limited and currently resolves to the IP address 172.67.221.111, which is advertised as part of AS13335 owned by Cloudflare, Inc. and geolocated to the United States. The site lacks an SSL certificate and its HTTP service has been taken offline as of the reporting date, July 25 2026. The page title observed during the brief capture reads “TronFeel - Buy TRON Energy, Rent TRX Energy, Swap TRX USDT | Save 70%”, and the underlying scam classification is identified as wallet/seed phishing with a specific focus on the Ledger brand.

VirusTotal scans reported three detections out of ninety‑three security vendors, and the domain appears on a single public security blocklist and is listed in the PhishDestroy repository. Independent scoring from Gridinsoft assigns a trust rating of zero out of one hundred, reinforcing the malicious assessment. While the exact content of the page has not been fully examined, the combination of brand impersonation, the promotional‑style title, and the low trust score strongly suggest a credential‑harvesting operation targeting cryptocurrency wallet users.

Defenders should block the domain at network perimeters, update web filtering and DNS sinkhole rules, and advise users to avoid providing Ledger seed phrases to any site presenting the tronfeel.net address. Continuous monitoring of Cloudflare‑hosted IP ranges for similar patterns is recommended, as is the inclusion of this indicator in threat‑intel feeds for rapid detection.