tronscaner[.]pro

This domain, tronscaner.pro, is flagged as a generic phishing site targeting cryptocurrency users under the guise of a KYC compliance solution. Analysis indicates it mimics legitimate AML/KYC services, likely to harvest login credentials, private keys, or deploy wallet-draining malware. The page title, 'KYC Check for Cryptocurrency - Complete Crypto Compliance Solution | AMLBot,' suggests an attempt to exploit trust in regulatory compliance processes, a common tactic in crypto-focused phishing campaigns. Infrastructure analysis reveals the domain was registered on March 22, 2026, through Web Commerce Communications Limited dba WebNic.cc. It resolves to the IP address 109.120.150.187 and is currently detected by 12 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and has a Gridinsoft trust score of 0/100. Technologies detected include Ubuntu, Nginx, and Facebook Pixel, which may indicate tracking or ad-based distribution methods. No association with legitimate KYC providers or cryptocurrency compliance tools was found. As of the latest assessment, tronscaner.pro has been taken offline, reducing immediate exposure risk. However, the domain remains a residual threat due to its recent registration and historical malicious activity. Users who interacted with the site should assume credential or wallet compromise and take immediate action: revoke connected dApp permissions, rotate passwords, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.