tronscanapi[.]net

Analysis of tronscanapi.net, created on 2025-10-06 and registered through NiceNIC International Group Co., Limited, shows that the domain resolves to the Cloudflare-hosted address 188.114.96.3, located in the United States under ASN 13335 (Cloudflare, Inc.). The site currently returns an HTTP response with the page title “Error” and does not present an SSL/TLS certificate, indicating that encrypted traffic is not available. Threat intelligence sources label the activity as a crypto-related phishing campaign. The domain appears in a single security blocklist and has been explicitly blocked by the PhishDestroy service.

AlienVault OTX references the domain in one pulse, and Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal scans report that six of ninety-five AV engines flag the domain as malicious, reinforcing the suspicion. The nameservers brit.ns.cloudflare.com and keenan.ns.cloudflare.com are standard Cloudflare resolvers, offering no additional attribution. The current status is offline, which may be a tactical takedown or temporary host removal; however, the infrastructure components remain active and could be reused for future campaigns.

Defenders should continue to block the domain at the DNS and proxy layers, monitor traffic to the associated IP address for anomalous patterns, and incorporate the domain and its IP into threat-intel feeds. Ongoing surveillance of newly registered domains using the same registrar or similar naming patterns is recommended to pre-empt re-use of the same infrastructure. Until further evidence emerges, the lack of a valid TLS certificate and the “Error” page title suggest that the site was not serving legitimate content at the time of observation.