tronrefund[.]icu

Analysis of the domain tronrefund.icu, observed on July 22, 2026, shows a clear pattern of brand impersonation targeting the TRON ecosystem. The site was registered on November 07, 2025 through Web Commerce Communications Limited and resolves to IP address 64.188.82.66, which is assigned to AS209693 (OC NETWORKS LIMITED) in Estonia. The domain does not present an SSL certificate, indicating an unencrypted HTTP service that is typical of low‑effort phishing infrastructure. The page title returned from the host is "TRON Commission Refund Service," matching the declared scam type of wallet/seed phishing and confirming the intent to lure TRON users into disclosing private keys or seed phrases.

The domain appears on a single security blocklist, specifically PhishDestroy, and has attracted a Gridinsoft trust score of 0 out of 100, the lowest possible rating. VirusTotal analysis records a single positive detection out of 93 scanning engines, confirming at least one vendor identified malicious behavior. No additional public blocklists or safe‑browsing services are referenced in the available intelligence.

Nameserver configuration uses Google's cloud DNS (ns-cloud-c1.googledomains.com through ns-cloud-c3.googledomains.com), a common choice for disposable phishing sites due to its reliability and ease of provisioning. The registrar information and hosting details suggest the operators selected a reputable DNS provider while keeping the underlying web service minimal.

Defenders should treat tronrefund.icu as a confirmed malicious actor. Recommended actions include adding the domain to local deny lists, blocking outbound connections to the resolved IP address, and monitoring for any future re‑registration or traffic spikes from the same ASN. Because the site is currently offline, retrospective forensic collection of HTTP responses (if cached) may aid in attributing the specific phishing kit used.