tronstation[.]top

The domain tronstation.top was registered through Tucows.com Co on 22 March 2026 and is presently classified as a high‑risk crypto phishing site. It appears on one external blocklist and has been flagged by PhishDestroy. VirusTotal reports three of ninety‑five security vendors as detecting malicious activity, reinforcing the elevated risk posture. Infrastructure analysis shows the domain resolves to the IP address 188.114.96.3, which is owned by a major content‑delivery network based in Canada. The authoritative name servers are deb.ns.cloudflare.com and javier.ns.cloudflare.com, confirming the use of the same CDN for DNS resolution. An SSL certificate issued by Let’s Encrypt (E7) is active, and HTTP requests return a 403 status code, indicating intentional access denial for direct requests. The web page served under the title “Tronvault” incorporates unpkg, jQuery, Axios, and Facebook Pixel scripts, and advertises HTTP/3 support. These components are typical of modern front‑end stacks but do not mitigate the observed phishing behavior. The presence of a Facebook Pixel suggests tracking of visitor interactions, a common tactic in credential‑harvesting campaigns. The combination of a crypto‑themed title, the “Tronvault” branding, and the high‑risk classification aligns with the reported crypto scam profile. Defenders should block traffic to tronstation.top at the DNS and network layers, and add the associated IP address 188.114.96.3 to deny lists. Email gateways must inspect URLs for the domain and quarantine messages that reference it. Continuous monitoring of threat‑intel feeds for any resurgence of the domain or its hosting infrastructure is advised, as the active status indicates ongoing operation.