trenlink[.]com[.]cn

On 30 July 2026 the domain trenlink.com.cn was registered through 厦门纳网科技股份有限公司. The domain resolves to the IPv4 address 94.154.43.26 and uses four nameservers: ns1.julydns.com, ns2.julydns.com, ns1.onclouddns.com, and ns2.onclouddns.com. The domain appears on a single security blocklist and is currently flagged by PhishDestroy as an active phishing infrastructure. VirusTotal has processed the domain with 91 antivirus and URL‑reputation engines; none of the engines raised a detection at the time of analysis. No additional public threat‑intel sources such as Google Safe Browsing, OTX, or SSL/TLS certificate transparency logs have been observed for this host.

The lack of detections in VirusTotal does not constitute evidence of benign behavior, and the recent creation date suggests a short operational window typical of opportunistic phishing campaigns. Analysis indicates that the domain is being used for a generic phishing campaign, although the specific lure or credential‑stealing vector has not been disclosed. The hosting IP 94.154.43.26 is not presently associated with known malicious infrastructure in public repositories, but the proximity of the registration date to the first blocklist entry implies rapid deployment. The registrar, a Chinese entity, and the four DNS providers may be leveraged to provide redundancy and to obscure takedown efforts.

Uncertainties remain regarding the content served by the site, the presence of TLS encryption, and the exact phishing target. Defenders should add trenlink.com.cn to internal blocklists, monitor DNS queries for the listed nameservers, and enforce outbound filtering of HTTP/HTTPS traffic to the IP address. Continuous re‑scanning with VirusTotal and inclusion in threat‑intel feeds is recommended to capture any future detections. Incident response teams should treat any credential submissions to this domain as compromised and initiate credential reset procedures for affected accounts.