tronlink[.]zip

This domain, tronlink.zip, was registered on 19 October 2025 via Gname.com Pte. Ltd. The authoritative nameservers a.share-dns.com and b.share-dns.net resolve the name to IP 194.102.104.223, an address assigned to AS48753 AVA HOST SRL in Moldova. The site presented an HTTPS service using a Let’s Encrypt R12 certificate and advertised the page title “TronLink Wallet | Trusted by over 10,000,000 users worldwide”. Technical fingerprints indicate an Nginx web server with HTTP Strict Transport Security enabled. Security‑vendor scans on VirusTotal reported that 11 of 94 antivirus engines flagged the domain, and the domain appears on one public blocklist, notably PhishDestroy, which has already taken the site offline.

A Gridinsoft trust score of 0 / 100 further underscores its malicious reputation. The content explicitly impersonates the Ethereum ecosystem and is classified as a wallet/seed phishing operation, aiming to harvest private keys or seed phrases from unsuspecting users. Current public data do not reveal the exact phishing page layout, credential‑capture mechanisms, or any downstream command‑and‑control infrastructure.

Defenders should continue to block the domain at DNS and network layers, monitor for any resurgence of the IP address, and add the associated nameservers to deny‑list configurations. Additional analysis of the HTTP response bodies, if archived, would clarify the exact credential‑collection vectors and support attribution of the threat actor. Until the infrastructure reappears, the evidence suggests a high‑confidence malicious site targeting Ethereum wallet users.