troniscan[.]lat

Analysis of the domain troniscan.lat indicates it is an active crypto scam site, registered on March 22, 2026, through Dynadot LLC. The domain resolves to IP address 188.114.97.3, hosted on Cloudflare infrastructure, with nameservers adelaide.ns.cloudflare.com and agustin.ns.cloudflare.com. The page title, 'Modular, muebles de diseño. Jujuy, Argentina - Estudio Modular, muebles de diseño,' suggests an attempt to impersonate a legitimate furniture design brand, though the exact content and functionality of the site remain unconfirmed beyond this metadata. Infrastructure analysis reveals the use of Cloudflare services, including HTTP/3, Cloudflare Browser Insights, and a Let's Encrypt SSL certificate (serial E7). Frontend technologies detected include Bootstrap, Alpine.js, jQuery, and Google Analytics, which are consistent with both legitimate and malicious sites. The domain is currently flagged by three security blocklists and has been identified as malicious by 3 of 91 security vendors on VirusTotal, though the specific detection signatures are not disclosed. The domain returns an HTTP 301 redirect, indicating it may be forwarding visitors to another destination, though the target URL is not specified in available data. Given the classification as a crypto scam, it is likely designed to deceive users into transferring cryptocurrency or divulging wallet credentials. Defenders should treat this domain as high-risk and prioritize blocking or monitoring traffic to 188.114.97.3. Further investigation into the redirect chain and any associated wallet addresses is recommended to assess the full scope of the campaign.