tronchainexplorer[.]live

Analysis of the domain tronchainexplorer.live, registered on August 03, 2026, indicates it is an active phishing site targeting users of the TRON blockchain ecosystem. As of August 04, 2026, the domain is flagged by 13 of 91 security vendors on VirusTotal, with detections including classifications such as phishing, malicious site, or fraudulent content. The domain also appears on one security blocklist and is actively blocked by PhishDestroy, suggesting a coordinated response from the security community. Infrastructure analysis reveals the domain is hosted on an IP address associated with bulletproof or low-reputation hosting providers, though specific ASN or geolocation data is not currently available.

The registrar details remain undisclosed, but the rapid flagging by multiple vendors within 24 hours of registration suggests a deliberate attempt to evade detection through short-lived infrastructure. The site returns a valid HTTP 200 status, indicating it is operational and serving content, though the exact nature of the phishing mechanism—whether credential harvesting, wallet drainer, or fake token distribution—has not been confirmed through content analysis. Defenders are advised to treat this domain as high-risk and implement immediate blocking at the DNS or network level. Organizations should monitor for connections to the domain, particularly from systems handling cryptocurrency transactions or interacting with TRON-based applications.

Given the domain's recent registration and rapid detection by security vendors, it is likely part of a broader campaign targeting users familiar with blockchain explorers. Further investigation into associated IPs, SSL certificates, or historical WHOIS data may reveal additional linked infrastructure, but as of this report, no such correlations have been established.