tronbank[.]icu

On July 31, 2026, analysis of the domain tronbank.icu was performed. The domain was created on July 30, 2026 and is registered through Fewmoretaps OU d/b/a Trustname.com. It resolves to the IPv4 address 186.2.175.35 and is served by the name servers ares.trustname.com, ns1.anycastdns.cz, ns2.anycastdns.cz, and zeus.trustname.com. The domain is currently listed on one public security blocklist and has been actively blocked by the PhishDestroy feed.

A VirusTotal scan submitted the domain to 91 antivirus and URL‑reputation engines; at the time of scanning none of the engines reported a detection. The absence of a detection does not constitute a statement of safety, and the domain remains classified as a banking‑phishing infrastructure. No public SSL certificate information, HTTP response codes, or page‑title metadata have been published for the site, so those aspects of the threat posture are presently unknown. Likewise, Safe Browsing and OTX references are not present in the available intelligence.

The short operational window—creation only one day prior to this report—combined with the use of a .icu TLD and the involvement of a known phishing‑blocking feed suggests a deliberate, rapid‑deployment campaign targeting financial credentials. Defenders are advised to add tronbank.icu to firewall, DNS filtering, and proxy blocklists, monitor the associated IP address 186.2.175.35 for anomalous traffic, and treat any email or web interaction with the domain as malicious. Ongoing observation of the registrar and name‑server configuration is recommended, as changes may indicate further campaign development. The domain remains active as of the report date and should be treated as a high‑confidence phishing indicator until takedown or remediation occurs.