# tronlinkswap.com — SUSPICIOUS

> PhishDestroy identifies tronlinkswap.com as a fake TronLink swap service. SSL-backed site (104.21.68.98) evades detection for now. Check the full report.

## Summary
PhishDestroy has flagged tronlinkswap.com as an active phishing domain impersonating the legitimate TronLink wallet swap interface. The site uses a Google Trust Services SSL certificate to lend false credibility while harvesting user credentials under the guise of a ‘swap’ service. With 0 detections on VirusTotal and no current presence on major blocklists, this threat remains under investigation but is already operational, posing immediate risk to cryptocurrency users seeking transaction tools.

Technical indicators confirm this domain was registered on July 29, 2025, through Gname.com Pte. Ltd., a registrar often associated with low oversight and high abuse potential. The site resolves to IP 104.21.68.98, hosted on a network known for facilitating phishing infrastructure. Despite its recent creation, the domain has evaded detection by most antivirus engines (0/95 on VirusTotal), likely due to its short operational lifespan and targeted nature. The combination of a freshly minted domain, obscure registrar, and absence from threat intelligence feeds highlights an evolving tactic where attackers leverage obscurity and speed to bypass defenses.

Users who visited tronlinkswap.com should immediately revoke any connected wallet permissions and transfer remaining assets to a secure, offline wallet. If credentials were entered, assume compromise and monitor for unauthorized transactions. Report the domain to your wallet provider and consider blacklisting it at the network level. Avoid interacting with this domain or similar ‘swap’ services unless verified through official channels, and use hardware wallets for high-value transactions to minimize exposure.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2025-07-29 14:08:47
- Registrar: Gname.com Pte. Ltd.
- IP: 104.21.68.98

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/9b77bff0-41b9-4a62-8f11-4d9fc1c5414e
- PhishDestroy: https://phishdestroy.io/domain/tronlinkswap.com/
- LLM endpoint: https://phishdestroy.io/domain/tronlinkswap.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/tronlinkswap.com/
Last updated: 2026-03-22