tron-links[.]xyz

PhishDestroy identifies tron-links.xyz as an active phishing domain masquerading as the legitimate TRON wallet extension. This site poses a direct threat to cryptocurrency users by attempting to steal TRON (TRX) and TRC-20 token private keys through a counterfeit wallet interface. The domain employs a lookalike naming convention to deceive visitors into believing they are accessing the official TRON Link wallet, which is widely used for managing TRON-based assets. Security teams should treat this domain as a high-risk credential phishing vector targeting TRON ecosystem users. This domain was flagged with a risk level of 'under_investigation' due to its recent creation and low detection count. VirusTotal currently shows zero detections out of 95 security vendors, highlighting the need for proactive blocking as signature-based detection may lag behind emerging threats. The domain was registered through Spaceship, Inc. on April 13, 2026, and resolves to IP address 172.67.145.252, which is associated with multiple low-reputation hosting providers. The SSL certificate issued by Let's Encrypt provides no security guarantee, as phishing sites frequently use free certificates to appear legitimate. If you or your users have visited tron-links.xyz or entered any TRON wallet credentials on this domain, immediately revoke all associated private keys and transfer funds to a newly generated wallet address. Check browser extensions for unauthorized TRON Link clones and scan devices for malware using reputable antivirus tools. Report the domain to your security team and consider blocking it at the network level. For further analysis, consult the full report using unique seed identifier 1d3675.