tronscaner[.]net

Tronscaner.net, a domain impersonating legitimate cryptocurrency services, has been taken down but initially posed a significant threat. It was flagged by 11 out of 95 vendors on VirusTotal, indicating a high level of malicious activity. The domain was first detected on the same day it was created, June 12, 2026, showcasing the rapid response capabilities of PhishDestroy.

The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and hosted on IP address 188.114.97.3. It utilized a Let's Encrypt SSL certificate, which is commonly used to give phishing sites a veneer of legitimacy. Despite its offline status, the initial detection and subsequent takedown highlight the importance of quick action in mitigating phishing threats.

With a platform risk score of 88 out of 100, tronscaner.net was a high-risk domain, specifically targeting users in the cryptocurrency sector. The presence on one public blocklist, including PhishDestroy's, further underscores the necessity for continuous monitoring and swift intervention to protect users from such malicious activities.