tronxdigital[.]com

This domain, tronxdigital.com, is currently flagged as a high-risk crypto scam targeting users through phishing techniques. Registered on February 21, 2026, via GoDaddy.com, LLC, the domain resolves to IP 199.36.158.100, hosted on AS54113 (Fastly, Inc.) in the United States. The page title, 'TronX ใช้งานสะดวก,' suggests a localized or brand-impersonation approach, though the exact content and targeted brand remain unconfirmed. Infrastructure analysis reveals the use of Firebase, Tailwind CSS, HSTS, and HTTP/3, indicating a modern, potentially evasive setup.

The domain is actively serving content with an HTTP 200 status and is protected by an SSL certificate issued by Google Trust Services (WR3). Detection data shows the domain appears on one security blocklist, and three of 95 security vendors on VirusTotal have flagged it as malicious. MX records point to Google’s mail servers, which may be leveraged for phishing campaigns or credential harvesting. The domain’s Gridinsoft trust score is 0/100, reinforcing its high-risk classification.

Defenders should treat this domain as an active threat, block it at the network level, and monitor for related indicators such as the resolved IP, nameservers (ns57.domaincontrol.com, ns58.domaincontrol.com), and associated SSL certificate. Given its recent registration and low detection rate, further investigation into its campaign infrastructure is recommended. No evidence currently links this domain to broader threat actor activity, but its persistence and technical indicators warrant immediate containment.