tron-tool[.]com

Analysis as of July 23, 2026 shows that the domain tron-tool.com was registered through Tucows Domains Inc. on October 7, 2025 and resolves to the Cloudflare‑hosted IP address 172.67.192.243, which geolocates to the United States under ASN 13335. The site delivered a page titled “USDT to TRX Conversion & TRON Energy Purchase | Fast, Secure, Reliable”, a wording that aligns with a cryptocurrency conversion lure and indicates a crypto‑drain operation. The page explicitly references the Telegram brand, confirming a brand‑impersonation motive aimed at Telegram users. No TLS certificate was observed, meaning the service ran over plain HTTP, and the Gridinsoft trust score was recorded as 0 / 100, reflecting extreme untrustworthiness. DNS resolution uses Cloudflare’s authoritative nameservers lakas.ns.cloudflare.com and opal.ns.cloudflare.com.

Multiple threat‑intel sources have flagged the domain. PhishDestroy listed it as blocked and the domain is currently taken offline. VirusTotal reported 12 detections out of 95 scanning engines, and AlienVault OTX referenced the domain in a single threat pulse. The domain also appears on one external security blocklist, reinforcing its malicious classification and justifying the elevated risk rating.

Uncertainty remains regarding the full payload or malicious binaries delivered to victims, as the page content beyond the title has not been publicly analysed. The specific phishing kit, if any, has not been recovered, limiting a complete behavioural profile. Defenders should continue to monitor the domain’s DNS and IP endpoints for any re‑activation, enforce URL filtering for the 172.67.192.243 address, and ensure corporate email gateways block references to “tron-tool.com”. Incident response teams are advised to share the observed indicators of compromise with threat‑intel feeds, consider sinkholing the IP address, and update blocklists to prevent future impersonation attempts targeting Telegram users.