tronenergy[.]mov

tronenergy.mov is currently flagged as an active brand‑impersonation domain with a high risk rating. Intelligence identifies Discord as the targeted brand, while the observed page title – “TronEnergy - Buy TRON Energy, Rent TRX Energy, Swap TRX USDT | Save 90%” – suggests a cryptocurrency‑focused offering. No direct evidence of Discord‑related login forms or malicious downloads has been publicly disclosed, so the precise abuse vector remains unverified.

The domain resolves to IP address 172.67.183.52, hosted within AS13335 operated by Cloudflare, Inc. DNS resolution uses the Cloudflare nameservers elma.ns.cloudflare.com and jason.ns.cloudflare.com, and the service supports HTTP/3. The TLS certificate is issued by Google Trust Services under the WE1 identifier, confirming a valid HTTPS endpoint despite the malicious intent.

Threat intelligence indicates that five of ninety‑five VirusTotal scanners have flagged the domain, reflecting a modest detection rate. The domain appears on one external security blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The low detection count suggests that automated analysis may not yet capture the full payload, and the single blocklist entry classifies the site as a social‑media impersonation vector.

Defenders should treat tronenergy.mov as a high‑confidence malicious indicator. Immediate mitigation steps include adding both the domain and its resolved IP address to network deny lists, configuring DNS sinkhole rules, and monitoring outbound HTTP/3 traffic to Cloudflare endpoints. Organizations are advised to educate users about unsolicited Discord‑related offers, enforce multi‑factor authentication, and continuously monitor newly registered Cloudflare‑hosted domains that reference Discord or cryptocurrency terminology to detect potential follow‑on campaigns.