tronscan[.]cam

PhishDestroy has flagged the domain tronscan.cam as an active crypto drainer impersonating the official TRON blockchain explorer, tronscan.org. This malicious site is designed to trick users into connecting crypto wallets under the guise of a legitimate block explorer, enabling unauthorized fund transfers to attacker-controlled addresses. The campaign leverages deceptive branding to exploit user trust in the TRON ecosystem, with no publicly documented drainer kit signature at this time, though behavioral analysis suggests a dynamic kit hosted on the domain.

This domain was registered through CSL Computer Service Langenbach GmbH d/b/a joker.com on April 28, 2026, and resolves to IP address 104.21.48.185. As of the latest scan, the domain carries a VirusTotal detection score of 1/95 engines and is secured with a Google Trust Services SSL certificate. The site remains unflagged in the Google Safe Browsing (GSB) database and is not currently listed on major threat intelligence blocklists. The recent creation date and lack of detections indicate this is a newly deployed threat with a low initial footprint.

The threat is currently active and under active investigation by PhishDestroy. Immediate defensive action includes adding the domain and its IP to organizational blocklists and monitoring for wallet connection attempts. Users are advised to verify site URLs manually, never interact with unsolicited links, and use hardware wallets when accessing blockchain explorers. While the current risk is elevated due to zero detections, the absence of proactive blocking increases exposure. Organizations are recommended to implement DNS filtering and endpoint protection to mitigate potential exposure until broader detection coverage is achieved.