ttronlink-wallet[.]webflow[.]io

The domain ttronlink-wallet.webflow.io is currently classified as a high‑risk crypto drainer and remains active as of the report date, August 04, 2026. Infrastructure analysis shows that the hostname resolves to the IP address 104.18.36.248, which is hosted on a platform operated by Webflow, Inc. The registration information confirms that the domain was provisioned through Webflow, indicating the use of a legitimate website‑building service to obtain a public‑facing URL. DNS queries return a NS_NOT_FOUND response, suggesting that authoritative name‑server records are either missing or deliberately obscured, a tactic often observed in malicious deployments to hinder attribution.

The domain has been listed by two independent phishing blocklists, specifically PhishDestroy and OpenPhish, and both services report it as blocked. VirusTotal scans have recorded detections from 12 of 91 security vendors, reinforcing the consensus that the site is malicious. No additional public blocklist identifiers or Safe Browsing entries were provided beyond the two named sources.

Defenders are advised to add the fully qualified domain name and its resolved IP address to network deny lists, enforce URL filtering rules that block access to the domain, and monitor outbound traffic for connections to 104.18.36.248. Because the hosting provider is a mainstream service, any takedown requests should be directed to Webflow’s abuse contact to accelerate remediation. Continuous re‑scanning of the domain is recommended, as threat actors may modify the payload or hosting configuration to evade detection.