tronssan[.]github[.]io

This domain, tronssan[.]github[.]io, is actively engaged in brand impersonation targeting Outlook users through a deceptive blockchain explorer facade. Analysis indicates the site presents itself as "TRONSCAN™ | TRON BlockChain Explorer | Official SIte," a clear attempt to exploit trust in legitimate cryptocurrency platforms. While no direct crypto drainer kit signatures have been confirmed, the infrastructure and content strongly suggest intent to harvest credentials or redirect users to malicious smart contracts under the guise of a trusted service.

Technical indicators confirm the domain’s malicious nature. VirusTotal reports 17 out of 95 security vendors flagging the domain, with additional listings on five independent blocklists, including PhishDestroy, Polkadot, and PhishingDB. The domain resolves to IP address 185.199.109.153, hosted by Fastly, Inc. (AS54113) in the United States, and is registered through GitHub Pages. The SSL certificate is issued by Let’s Encrypt (R12), a common but not exclusive indicator of legitimate domains. No creation date is publicly available due to GitHub Pages’ infrastructure, and Google Safe Browsing (GSB) status remains unconfirmed at this time.

As of the latest assessment, tronssan[.]github[.]io remains active and unmitigated, posing a continued risk to users. The domain’s hosting on GitHub Pages complicates traditional takedown procedures, requiring coordination with the platform’s abuse team. Users are advised to treat any interaction with this domain as malicious, particularly if prompted for login credentials or wallet connections. Organizations should update blocklists to include this domain and its associated IP, while end-users should verify the authenticity of blockchain explorers through official sources before engagement.