tronminners[.]biz

The domain tronminners.biz was registered on May 27 2026 through OwnRegistrar, Inc. It resolves to the IPv4 address 198.251.84.200, which is geolocated to Luxembourg and attributed to FranTech Solutions. The site presents a TLS certificate issued by Let’s Encrypt (R13). The HTML title returned by the server is “TronMinners‑ Home”, matching the domain branding.

Network probing shows the web server returns an HTTP 302 status code, indicating a redirection to a secondary location. The domain is currently flagged as active and has been added to the PhishDestroy blocklist. VirusTotal reports that 2 of 95 security vendors have identified the host as malicious, while Gridinsoft assigns a trust score of 1 out of 100. The domain appears on a single external blocklist.

Analysis of the branding and the “TronMinners” name suggests the site is being used to impersonate legitimate Tron cryptocurrency mining or wallet services. The combination of a fresh registration, low trust score, and redirection behavior is consistent with credential‑harvesting phishing campaigns that lure victims into submitting private keys or login details. No additional infrastructure, such as known phishing kits or command‑and‑control endpoints, has been observed, leaving the exact payload delivery method uncertain.

Defenders should immediately add tronminners.biz and its resolving IP 198.251.84.200 to network deny lists and configure URL filtering to block access. Monitoring of outbound connections to the IP can reveal compromised hosts attempting to retrieve the phishing page. Email gateways should be tuned to detect subject lines or content referencing Tron mining or “TronMinners”. Continuous re‑evaluation of the domain’s reputation is advised, as the threat actor may shift hosting or adjust redirect targets.