troninfrastructure[.]org

Analysis of troninfrastructure.org indicates that the domain was registered on 10 March 2026 through Spaceship, Inc. and configured with the authoritative nameservers launch1.spaceship.net and launch2.spaceship.net. The site resolved to the IPv4 address 107.189.20.73, which geolocates to the Netherlands and is associated with FranTech Solutions. No TLS certificate was observed, implying the service operated over plain HTTP. The web server identified by passive fingerprinting is Nginx. The page title returned from the live host, before it was taken offline, read “TronInfrastructure.org — Enterprise Technical Node Infrastructure Services,” a phrasing that could be leveraged to attract victims interested in technical infrastructure or cryptocurrency services.

The domain appears on a single security blocklist and has been blocked by the PhishDestroy filtering service. VirusTotal analysis shows that two of ninety‑four security vendors flagged the domain, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The threat is classified as a crypto scam, consistent with the observed page title and the lack of legitimate branding. At the time of reporting the site is offline, limiting immediate access to the payload, but the infrastructure remains observable.

Uncertainty remains regarding the exact phishing content, credential harvesting mechanisms, or any associated command‑and‑control infrastructure, as no sample page content or malware indicators have been disclosed. Defenders should continue to block the domain and its resolved IP address, add the domain to internal blocklists, monitor for any re‑registration attempts, and inspect traffic for connections to 107.189.20.73. Additional scrutiny of other domains registered through Spaceship, Inc. or hosted on the same IP range is advisable, as threat actors often reuse infrastructure.