# PhishDestroy domain threat record: trc20chain.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/trc20chain.com/
Machine-readable companion: https://phishdestroy.io/domain/trc20chain.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-06 22:21:00 UTC
- Last availability or vendor check: 2026-10-22 10:11:18 UTC
- Stored record updated: 2026-10-22 15:46:00 UTC
- VirusTotal detections in the stored snapshot: 6/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 46.29.26.38
- Registrar in stored WHOIS data: Onlinenic Inc
- Registrar country in stored WHOIS data: DE
- Registration date (registry RDAP, trc20chain.com): 2026-05-13 18:41:03 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1134c-c3d2-7140-aa6c-87cf9336edc4/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/trc20chain.com
- Certificate Transparency search: https://crt.sh/?q=%25.trc20chain.com
- Web Archive lookup: https://web.archive.org/web/*/https://trc20chain.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
trc20chain.com is on the PhishDestroy blocklist as a suspicious domain. Its name borrows the TRC-20 token standard used on the TRON network, which makes it look relevant to anyone holding or sending TRON-based tokens such as stablecoins. PhishDestroy first saw it on 2026-10-07. When last checked on 2026-10-19, the site still responded, but DNS for its content was inactive.

How the scam works
The page shows only the title "Loading", so it gives a visitor no content that explains what the site offers. That page title does not match a specific scheme, and PhishDestroy has not assigned one to this domain. The risk comes from the combination of a crypto-themed name, a placeholder page and vendor flags. Sites like this often lead TRC-20 users toward a wallet connection, a deposit address or a login form. If any of those steps succeed, the victim can lose the tokens or credentials involved.

Evidence
On 2026-10-11, VirusTotal showed 6 of 92 engines flagging the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, SOCRadar and Webroot. That is a minority of engines, but six independent vendors agreeing is meaningful for a domain this new. Spamhaus lists it in its Domain Block List under the spam category. It also appears in two AlienVault OTX threat pulses, which means other researchers have tied it to tracked malicious activity.

Infrastructure
The domain was registered on 2026-05-13 through Onlinenic Inc, about five months before PhishDestroy detected it. Registering a domain early and activating it later is common for throwaway crypto domains. The site sits at 46.29.26.38 on the M/S ROBI TRADERS network in Turkey.

What to do
Do not connect a wallet, send tokens or enter a seed phrase or password on trc20chain.com. If you connected a TRON wallet there, review its token approvals and revoke any you did not intend to grant. If you entered a seed phrase, move your funds to a new wallet right away. If you sent funds, keep the transaction IDs and report them to the exchange or wallet provider involved. Defenders should block the domain and its IP at DNS and proxy level, and search logs for any earlier visits from users.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1134c-c3d2-7140-aa6c-87cf9336edc4/
VirusTotal report: https://www.virustotal.com/gui/domain/trc20chain.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=trc20chain.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:44:00 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/gb90Xsq8/bc56a3d91f8c.png
  Captured: 2026-10-06 22:21:00 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a1134c-c3d2-7140-aa6c-87cf9336edc4.png
  Captured: 2026-10-06 22:21:00 UTC
  Source report: https://urlscan.io/result/01a1134c-c3d2-7140-aa6c-87cf9336edc4/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c8ff171e-416b-4390-9a91-7fed7d9e5a1f.png
  Captured: 2026-10-06 22:53:51 UTC
  Source report: https://radar.cloudflare.com/scan/c8ff171e-416b-4390-9a91-7fed7d9e5a1f
  SHA-256: b9c22f0f3209f2879916e2b5dbfdcf88a7fa9f553a19ec3329468dfab5af5caf
- URLQuery: https://screenshots.phishdestroy.io/uq/f124ee1f-d439-4b5d-8d12-0ee70bf85bc3.png
  Source report: https://urlquery.net/report/f124ee1f-d439-4b5d-8d12-0ee70bf85bc3
  SHA-256: 0c0f81c2c94ec30e58091918db46a91de4075ce151c4676ec379939341ff11e2
- URLScan · 2026-10-06: https://screenshots.phishdestroy.io/us/01a11324-9d4e-754b-a7bb-4e9c09bf5ba9.png
  Captured: 2026-10-06 21:35:40 UTC
  Source report: https://urlscan.io/result/01a11324-9d4e-754b-a7bb-4e9c09bf5ba9/
  SHA-256: 19ce124094f88d97153d18caa9d714cb35e2645b5ed6c81f84a31a0646a61d9a
- URLScan · 2026-10-06: https://screenshots.phishdestroy.io/us/01a11326-e14e-7521-b137-a466e0b03fd1.png
  Captured: 2026-10-06 21:38:13 UTC
  Source report: https://urlscan.io/result/01a11326-e14e-7521-b137-a466e0b03fd1/
  SHA-256: 542467d4a352d4f1be4bab3f47baea5271434f6ea410bd221162e47e5c080569

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T19:30:23Z",
        "uuid": "01a1134c-c3d2-7140-aa6c-87cf9336edc4",
        "scanned_at": "2026-10-06T22:19:27Z",
        "final_url": "https://trc20chain.com/",
        "status": 200,
        "ip": "46.29.26.38",
        "ips": [
            "46.29.26.38"
        ],
        "asns": [
            "132359"
        ],
        "countries": [
            "TR"
        ],
        "doc_hash": "0f7f73cfb9af7dd4f923de4502d49f5ccffe498b3f80c61d97d8a9e247907342",
        "globals": [
            "_d3b5",
            "_a4e1",
            "_f818",
            "_s9aa",
            "_x0c6",
            "_x919",
            "_x586",
            "_xdf5",
            "_x017",
            "_xd18",
            "_x607",
            "_x32d",
            "_x425",
            "_xd5c",
            "_xf37",
            "_x76b",
            "_x082",
            "_xabf",
            "_xdff",
            "_xd11",
            "_xcff",
            "_xbef",
            "_x0e2",
            "_xcba",
            "_xa4e",
            "_xe12",
            "_x9ac",
            "_x98e",
            "_x260",
            "_x098",
            "_xcf3",
            "_x0b3",
            "_xf0d",
            "_x49a",
            "_x58d",
            "_x51e",
            "_x8d9",
            "_xc27",
            "_xb2a",
            "_xfba"
        ],
        "cookies": [
            "sil_ses",
            "__Host-sil_ses",
            "sil_gate",
            "__Host-sil_gate"
        ],
        "tls": {
            "san": [
                "trc20chain.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "trc20chain.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-28T19:45:44Z",
            "valid_from": "2026-09-29T19:45:45Z"
        },
        "domain_age_days": 1236,
        "apex_age_days": 1236,
        "tls_age_days": 7,
        "tls_valid_days": 89,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 81,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T19:39:30Z",
        "uuid": "c8ff171e-416b-4390-9a91-7fed7d9e5a1f",
        "scanned_at": "2026-10-06T22:53:51Z",
        "final_url": "https://trc20chain.com/",
        "status": 200,
        "history": [
            {
                "url": "https://trc20chain.com/",
                "status": 200
            }
        ],
        "dom_hash": "bc948235e9efeda3c8d176de53504109efd904a0c8a0ba260d9c0d5db04d3bb4",
        "doc_hash": "43a33805944186fca67f38771184c8018a953b06166e837860ba9131185aa903",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "trc20chain.com",
                "type": "A",
                "value": "46.29.26.38"
            }
        ],
        "dnssec_valid": false,
        "ip": "46.29.26.38",
        "whois": {
            "registrar": "OnlineNIC, Inc.",
            "created": "2026-05-13T18:41:03Z",
            "updated": "2026-09-29T20:42:37Z",
            "expires": "2027-05-13T18:41:03Z",
            "nameservers": [
                "a.dnspod.com",
                "b.dnspod.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T11:49:52Z",
        "analysis_at": "2026-10-12T12:15:02Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 5,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "alphaMountain.ai": "spam",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Spam (alphaMountain.ai)"
        },
        "registrar": "OnlineNIC, Inc.",
        "created": "2026-05-13T18:41:03Z",
        "expires": "2027-05-13T18:41:03Z",
        "updated": "2026-09-29T20:42:37Z",
        "first_seen": "2024-03-06T01:41:31Z",
        "dns": [
            {
                "ttl": 180,
                "type": "SOA",
                "rname": "domainadmin.dnspod.com",
                "value": "a.dnspod.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "b.dnspod.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "c.dnspod.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "a.dnspod.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "46.29.26.38"
            }
        ],
        "dns_at": "2026-10-07T02:00:25Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "trc20chain.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "5107a7adbd8935227b1d7dd5780a37cff61",
            "sha256": "4af7768462ddf3d44e962c4772ba31570d480031005be6d608f91e52081b088c",
            "subject": "trc20chain.com",
            "valid_to": "2026-12-28T19:45:44Z",
            "valid_from": "2026-09-29T19:45:45Z"
        },
        "whois": {
            "registrar": "OnlineNIC, Inc.",
            "registrar_iana_id": "82",
            "registrar_url": "http://www.onlinenic.com",
            "created": "2026-05-13T04:00:00Z",
            "updated": "2026-09-29T16:22:06Z",
            "expires": "2027-05-13T04:00:00Z",
            "status": [
                "ok"
            ],
            "nameservers": [
                "a.dnspod.com",
                "b.dnspod.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "expiration": "2027-05-13T04:00:00Z",
                "registration": "2026-05-13T04:00:00Z",
                "registrar expiration": "2027-05-13T04:00:00Z",
                "last update of RDAP database": "2026-09-29T16:22:06Z"
            }
        }
    }
}
```