# PhishDestroy threat dossier — tronllnk.com.cn ================================================================ Fetched: 2026-05-07 12:29:24 UTC Canonical: https://phishdestroy.io/domain/tronllnk.com.cn/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: content_divergence) (score: 5/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/95 security vendors flagged this domain ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 34.228.224.102 (US, Ashburn) ASN: AS14618 Amazon.com, Inc. Hosting org: AWS EC2 (us-east-1) Registrar: 浙江贰贰网络有限公司 Nameservers: ns1.22.cn, ns2.22.cn Registered: 2026-05-04 Page title: 波宝钱包下载中心 | TronLink官方安全连接 TRON 生态 HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R12 Expires: 2026-08-02 Status: INVALID chain Fingerprint: 1ff359447b8da468e4cb558d6bae5013647eed011ff5547f0d7f7ff9bd993c1d ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-04 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-07 09:42:15 UTC (by PhishDestroy tracker) First reported: 2026-05-07 06:42:10 UTC (abuse notice filed) Last verified: 2026-05-07 14:00:39 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019e012a-51cf-7702-9f53-6732bc94f27a/ Wayback Machine: https://web.archive.org/web/*/tronllnk.com.cn crt.sh CT logs: https://crt.sh/?q=%25.tronllnk.com.cn Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=tronllnk.com.cn AlienVault OTX: https://otx.alienvault.com/indicator/domain/tronllnk.com.cn URLhaus: https://urlhaus.abuse.ch/host/tronllnk.com.cn/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-07 09:44:44 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy’s seed 39955c analysis confirms tronllnk.com.cn is an active crypto-draining domain masquerading as the legitimate TronLink wallet portal. Users who interact with this fraudulent login page risk unauthorized transfers of TRX and TRC-20 tokens to attacker-controlled wallets. The domain leverages a deceptive visual clone of TronLink’s interface to harvest credentials and seed phrases, then initiates silent on-chain transactions to siphon funds. Blockchain explorers have already flagged multiple outflow addresses linked to this campaign, indicating coordinated theft in progress. This domain presents a critical threat due to its low detection footprint and professional replication of TronLink’s branding. VirusTotal currently shows 0 detections out of 95 engines as of today, suggesting evasion of signature-based defenses. It resolves to IP 34.228.224.102, hosted on AWS infrastructure operated by 浙江贰贰网络有限公司, and secured with a Let’s Encrypt SSL certificate issued May 4, 2026. The domain’s recent creation and clean WHOIS history indicate opportunistic registration timed to coincide with Tron ecosystem growth, maximizing exposure before takedown. Users who visited tronllnk.com.cn should immediately revoke any connected TRC-20 token approvals via TronLink’s official dApp browser or wallet settings. Transfer remaining assets to a newly generated address on a hardware wallet or clean software instance. Scan devices with PhishDestroy for dormant malware and rotate seed phrases used on fraudulent sites. Organizations should add 34.228.224.102 and *.tronllnk.com.cn to network blocklists, while TronLink users should verify all links via their official app or website tronlink.org before any input. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260507-F4E6E7 Favicon MD5: e1dd02b0b438538ba47084ce977a994d TLS cert SHA-256: 1ff359447b8da468e4cb558d6bae5013647eed011ff5547f0d7f7ff9bd993c1d ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/tronllnk.com.cn/ JSON API: https://api.destroy.tools/v1/check?domain=tronllnk.com.cn Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 146,854 domains (52,758 alive under monitoring, 93,831 confirmed takedowns/dead). Site: https://phishdestroy.io