tron-skan[.]com

PhishDestroy identifies tron-skan.com as an active, elevated-risk phishing domain designed to mimic legitimate Tron cryptocurrency wallets and steal user credentials or funds. The domain is currently unresolved by most major blocklists, enabling it to persist in the wild despite its malicious intent. Users interacting with this page risk permanent loss of digital assets and personal data exposure.

This domain was flagged by only 1 out of 95 VirusTotal security vendors, indicating a low detection rate among automated defenses. It is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for minimal abuse oversight. The site operates under a Let’s Encrypt SSL certificate, further enhancing its appearance of legitimacy. As of analysis, tron-skan.com resolves to IP address 172.67.185.97, hosted within Cloudflare’s infrastructure. The domain itself was created on April 25, 2026—suggesting a very recent and rapidly deployed threat.

To mitigate exposure to this and similar credential-harvesting domains, users should refrain from clicking links in unsolicited messages or advertisements. Always verify website URLs against official sources before entering sensitive information or making transactions. Organizations are advised to block both the domain and IP in DNS and firewall policies and to deploy browser isolation or advanced threat prevention tools that detect low-prevalence phishing pages. Immediate reporting of this domain to security teams or abuse contacts can help accelerate takedown efforts before further damage occurs.