tronsafe[.]io

Analysis indicates that the domain tronsafe.io is actively used in a high‑risk crypto‑scam campaign. The domain was registered on 21 February 2026 through Web Commerce Communications Limited dba WebNic.cc and resolves to IP 172.67.168.174, which is part of AS13335 owned by Cloudflare, Inc., located in the United States. DNS resolution uses the Cloudflare authoritative nameservers lynn.ns.cloudflare.com and izabella.ns.cloudflare.com, and the site presents a valid SSL certificate issued by Google Trust Services (WE1). An HTTP request returns a 403 status and the page title is “Just a moment…”, providing no further visible content. VirusTotal scans report that 2 of 93 security vendors flagged the domain, while Gridinsoft assigns a trust score of 0 / 100. The domain is listed on three public blocklists and is already blocked by PhishDestroy, MetaMask, and SEAL. The limited publicly available artifacts suggest the infrastructure is purpose‑built for a cryptocurrency‑related phishing operation, but the exact phishing flow and any harvested credentials remain unknown. Defenders should block DNS resolution and network traffic to 172.67.168.174, add tronsafe.io to internal blocklists, and continue monitoring for related indicators such as the associated nameservers and SSL fingerprint. Ongoing observation is recommended to capture any payload or redirect behavior that may emerge.