tron-safe[.]com

Analysis of the domain tron-safe.com, observed on 28 July 2026, confirms that it is currently active and classified as a high‑risk generic phishing site. The domain resolves to four authoritative name servers – dns1.regway.com, dns2.regway.com, dns3.regway.com and dns4.regway.com – all of which are hosted by the registrar Realtime Register B.V. An HTTP request to the root URL returns a 200 OK status, indicating that a web service is reachable. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy feed, demonstrating that at least one anti‑phishing repository has flagged the host.

VirusTotal has processed the domain with 91 security engines, of which three returned a positive detection, reinforcing the suspicion of malicious intent. No additional intelligence such as SSL certificate details, IP address attribution, or content titles is available in the current data set, leaving the precise hosting location and page content undocumented. The limited detection count suggests that the phishing campaign may be in an early deployment stage or that detection signatures have not yet been widely propagated.

Defenders should continue to monitor the domain, enforce blocklist rules that include the identified nameservers, and ensure that any inbound traffic to the host is denied at perimeter controls. Given the confirmed high‑risk rating and active status, immediate inclusion of tron‑safe.com in web filtering and intrusion‑prevention policies is advised, along with periodic re‑scans to capture any changes in detection coverage.