# tronlinkbrowser.com — SUSPICIOUS

> tronlinkbrowser.com is a live crypto-draining phishing site flagged by PhishDestroy; 0/95 VirusTotal detections as of July 04, 2025.

## Summary
PhishDestroy identifies tronlinkbrowser.com as an active crypto-draining phishing domain engineered to trick visitors into connecting cryptocurrency wallets and silently siphon tokens. The site mimics the legitimate TronLink browser extension interface and prompts wallet connections under false “security update” or “KYC verification” pretexts, after which it drains supported tokens via smart-contract approvals. Once a wallet is linked, the drainer executes pre-configured transfer functions without requiring additional signatures, immediately transferring assets to attacker-controlled addresses. Users who click through may lose entire balances within minutes.  

This domain was flagged on July 04, 2025, the same day it was created. It currently resolves to IP address 188.114.97.3, is registered through Gname.com Pte. Ltd., and holds an SSL certificate issued by Google Trust Services—all of which are common cloaking tactics to appear legitimate at first glance. VirusTotal currently shows zero detections out of 95 engines, indicating it remains under the radar for antivirus and browser filters, leaving visitors exposed. The combination of a brand-new domain, low detection rate, and hosting on a bulletproof-friendly ASN suggests a rapidly evolving campaign targeting Tron ecosystem users specifically.  

If you visited tronlinkbrowser.com do not connect any wallet or enter any credentials. Revoke any token approvals immediately by visiting the TronLink wallet or using a reputable revoke tool such as revoke.cash; connect a wallet you control only after verifying the exact URL matches tronlink.org. Clear browser cache and cookies to remove session tokens. Report the site at PhishDestroy.com/submit to help block future visitors. Always download browser extensions directly from the official TronLink website and verify the extension ID in your browser’s add-on manager before use.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2025-07-04 08:47:25
- Registrar: Gname.com Pte. Ltd.
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/74ce2c54-92d3-4401-b232-42b1f4eedea2
- PhishDestroy: https://phishdestroy.io/domain/tronlinkbrowser.com/
- LLM endpoint: https://phishdestroy.io/domain/tronlinkbrowser.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/tronlinkbrowser.com/
Last updated: 2026-03-24