tronbank[.]pro

This investigation documents the active infrastructure associated with tronbank.pro, a domain registered on March 5 2026 through Amazon Registrar, Inc. The site serves a crypto‑focused banking phishing campaign, as indicated by the page title “TronBank.Pro” and the classification “Crypto Scam.” DNS resolution points to the Amazon‑owned IP address 13.229.183.88, located in Singapore under ASN 16509. The web server is identified as Nginx hosting a Vue.js application, and the site presents a valid Let’s Encrypt certificate (R13). Automated scans report an HTTP 200 response, while a Gridinsoft trust score of 0 / 100 and detection by two of ninety‑four VirusTotal scanners underscore its malicious nature. The domain appears on one external blocklist and has been flagged by the PhishDestroy sinkhole. Despite these indicators, the site remains reachable, suggesting that mitigation at the network level may be incomplete. Defenders should add the domain and its hosting IP to blacklist policies, monitor DNS queries for the four listed AWS nameservers, and enforce TLS inspection to capture any credential exfiltration attempts. Ongoing observation is advised to detect potential content changes or additional infrastructure expansion.