tronvina[.]com

The domain tronvina.com was registered on May 04, 2026 through Navicosoft Pty Ltd and is currently active. It resolves to 188.114.96.3, an IP owned by Cloudflare (AS13335) located in the United States. The site presents a page titled “TRC20 Energy Rental Service” and serves content over HTTPS with a Let’s Encrypt/E8 certificate. Nameservers arnold.ns.cloudflare.com and marge.ns.cloudflare.com indicate the infrastructure is fully CDN‑managed, a pattern often used to hide origin servers.

Technical scans show a mixed detection record: VirusTotal reports a single positive out of 95 security‑vendor scans, and Gridinsoft assigns a trust score of 0/100. The domain is listed on one public blocklist and has been actively blocked by the PhishDestroy service. An HTTP request returns a 200 status code, confirming the page is live and reachable.

While the available evidence points to a generic phishing operation targeting users interested in TRC20 token rentals, the limited number of vendor detections and the single blocklist entry leave several uncertainties. It is not yet clear whether additional IP addresses or fast‑flux techniques are being employed, nor is there public information about associated command‑and‑control infrastructure or payload delivery methods. Continuous monitoring of DNS changes and traffic patterns is recommended to detect any expansion of the campaign.

Defenders should add tronvina.com to domain blocklists and enforce outbound filtering for connections to its IP address. Network sensors should be tuned to alert on TLS handshakes using the Let’s Encrypt/E8 certificate for this host. User‑facing communications must warn employees and customers that any unsolicited request to rent TRC20‑related energy services originating from this domain is malicious. Ongoing threat‑intel feeds should be consulted for any new indicators that may emerge as the campaign evolves.