tronenergy[.]fyi

The domain tronenergy.fyi was registered through Tucows Domains Inc. on 12 December 2025 and is presently marked as offline. Infrastructure analysis shows the name servers 1‑ceci.njalla.do, 2‑nest.pipe.ma, and 3‑pas.njalla.in resolve the domain to the IP address 188.114.96.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. No TLS certificate is presented; the site operates without HTTPS, and Gridinsoft assigns a trust score of 0 out of 100, indicating a complete lack of credibility. The page title returned by the HTTP response is "TronEnergy - Buy TRON Energy, Rent TRX Energy, Swap TRX USDT | Save 90%", which does not reference the targeted brand but the threat intelligence explicitly lists Discord as the impersonated brand.

The scam classification is identified as wallet/seed phishing, suggesting the site attempts to harvest cryptocurrency wallet credentials or seed phrases. VirusTotal analysis records three of ninety‑five scanning engines flagging the domain as malicious, providing independent confirmation of hostile intent. The domain appears on a single public security blocklist and is actively blocked by the PhishDestroy service. These detections, combined with the zero‑score trust rating and lack of TLS, raise the risk assessment to elevated.

Given the available evidence, defenders should add 188.114.96.3 to network‑level deny lists, enforce DNS blocking of tronenergy.fyi, and monitor for any future re‑hosting attempts. Continuous re‑scanning on multi‑engine platforms is recommended to capture any changes in the payload or hosting infrastructure. Organizations that rely on Discord for authentication should educate users about unsolicited requests for wallet seeds and enforce multi‑factor authentication where possible.