troncheckwallet[.]com

Analysis of the domain troncheckwallet.com shows a newly registered crypto‑drainer site created on February 21, 2026. The domain resolves to the Cloudflare address 104.21.64.238, which is associated with ASN 13335 (Cloudflare, Inc.) and appears to be hosted in the United States. No TLS certificate is presented, and HTTP requests return a 404 Not Found page title, indicating that the web service is unavailable or intentionally removed. Reputation data is extremely poor: Gridinsoft assigns a trust score of 0 / 100, and three of ninety‑three VirusTotal scanners have flagged the domain as malicious.

The registrar is listed as Eranet International Limited, and the authoritative nameservers are chance.ns.cloudflare.com and gabriella.ns.cloudflare.com. The domain has been added to three external blocklists, including PhishDestroy, MetaMask, and SEAL, confirming that security‑focused services have already taken mitigation steps. Current status is offline, which limits immediate interaction but does not eliminate the risk of re‑activation.

Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurrection attempts, and add the IP address 104.21.64.238 to deny‑list rules where feasible. Because the site lacks a valid SSL certificate and returns a generic 404 page, automated content inspection yields no further artifacts; however, the combination of recent creation, low trust score, vendor detections, and blocklist listings provides sufficient confidence to treat troncheckwallet.com as a high‑confidence crypto‑drainer threat. Continuous watch‑listing and periodic re‑scans are recommended to capture any future changes in hosting or content.