trontokenapi[.]com

The domain trontokenapi.com was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently taken offline. DNS configuration shows the domain is delegated to Cloudflare name servers (arvind.ns.cloudflare.com and ursula.ns.cloudflare.com) and resolves to the IP address 104.21.21.226, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented an SSL certificate issued by Google Trust Services under the WE1 designation, indicating the use of a valid HTTPS certificate. Observed web technologies include Cloudflare’s edge services and HTTP/3 support, consistent with the hosting provider’s deployment.

VirusTotal analysis recorded four detections out of ninety‑three scanning engines, suggesting that a minority of security vendors have identified malicious characteristics. The domain is listed on three public blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the perception of a threat. The page title returned by the server is simply "Error," providing no further contextual clues about the content that was served. The intelligence categorizes the campaign as a crypto‑related scam, though the exact phishing vector or victim interaction details have not been disclosed.

Because the site is offline, direct content analysis is limited; however, the combination of a recent registration, Cloudflare infrastructure, a valid SSL certificate, and multiple vendor detections aligns with typical patterns observed in cryptocurrency phishing operations. Defenders should continue to monitor the associated IP address and Cloudflare name servers for any reactivation, ensure that blocklist entries remain enforced, and consider adding the domain to internal deny lists. Additional investigation of related domains registered by the same registrar or sharing the same name server set may reveal further infrastructure components of this campaign.