# PhishDestroy threat dossier — tronlilnk.cn ================================================================ Fetched: 2026-05-07 13:37:02 UTC Canonical: https://phishdestroy.io/domain/tronlilnk.cn/ ## VERDICT ---------------------------------------------------------------- HIGH THREAT — malicious activity confirmed Composite threat score: 65/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/95 security vendors flagged this domain ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 192.238.201.88 (HK, Central) ASN: AS138995 Antbox Networks Limited Hosting org: SpeedVM Network Group LLC Registrar: 杭州爱名网络有限公司 Nameservers: ns1.22.cn, ns2.22.cn Registered: 2026-05-04 Page title: 波宝钱包下载 - TronLink钱包官方网站 HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R13 Expires: 2026-08-02 Status: INVALID chain Fingerprint: 6cc5de71eca6b4f5b47c5799d21bf8d1281d03dbcd310e6b3e78bd21a3c24c04 Subject Alternative Names (related infrastructure — often same operator): - www.tronlilnk.cn ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-04 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-07 09:37:09 UTC (by PhishDestroy tracker) First reported: 2026-05-07 06:37:55 UTC (abuse notice filed) Last verified: 2026-05-07 14:00:38 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019e0126-0ac0-72d3-a048-b1cc16a48614/ Wayback Machine: https://web.archive.org/web/*/tronlilnk.cn crt.sh CT logs: https://crt.sh/?q=%25.tronlilnk.cn Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=tronlilnk.cn AlienVault OTX: https://otx.alienvault.com/indicator/domain/tronlilnk.cn URLhaus: https://urlhaus.abuse.ch/host/tronlilnk.cn/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-07 09:38:39 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies tronlilnk.cn as an active crypto drainer impersonating the legitimate TronLink wallet extension. The domain poses an immediate threat to cryptocurrency users by tricking victims into connecting their wallets to malicious smart contracts, enabling unauthorized fund transfers. This scam mirrors legitimate TronLink interfaces to harvest private keys and seed phrases, with stolen assets typically redirected to mixing services within minutes of compromise. Technical analysis confirms the domain resolves to 192.238.201.88 and employs a Let's Encrypt SSL certificate, adding false legitimacy to phishing pages. This domain was flagged with 0 detections out of 95 VirusTotal scanners as of the investigation date, indicating it evades most automated detection systems. The domain was registered through 杭州爱名网络有限公司 on May 04, 2026, a recently created domain with no established reputation. The combination of fresh registration, low detection rates, and active hosting infrastructure suggests this is a short-lived campaign designed to maximize victim engagement before takedown. Threat intelligence shows similar domains in this campaign follow a pattern of targeting Tron ecosystem users through social media and messaging platforms. Users who visited tronlilnk.cn should immediately disconnect their wallets, revoke any connected smart contracts, and transfer remaining funds to a new wallet. Generate new seed phrases and private keys for all affected accounts. Scan devices for malware with reputable antivirus software, as crypto drainers often deploy keyloggers or clipboard hijackers. Report the domain to PhishDestroy and your wallet provider, and warn others in Tron communities about this active threat. Always verify wallet URLs against official sources before entering sensitive information or connecting extensions. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260507-EF7DEE Favicon MD5: e1dd02b0b438538ba47084ce977a994d TLS cert SHA-256: 6cc5de71eca6b4f5b47c5799d21bf8d1281d03dbcd310e6b3e78bd21a3c24c04 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/tronlilnk.cn/ JSON API: https://api.destroy.tools/v1/check?domain=tronlilnk.cn Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 146,920 domains (52,558 alive under monitoring, 94,028 confirmed takedowns/dead). Site: https://phishdestroy.io