tronliink[.]cyou

This domain, tronliink.cyou, is confirmed to operate as a credential theft site targeting TRON cryptocurrency wallet users. Analysis indicates the site impersonates the legitimate TRONLink wallet interface, presenting itself as "TronLink | 您的TRON生态入口 - 安全去中心化钱包 | 官方网站" to deceive victims into entering private keys or recovery phrases. The threat actor employs brand impersonation tactics, specifically mimicking the TRONLink wallet, a widely used decentralized application (dApp) interface for the TRON blockchain. No direct evidence of a crypto drainer kit was observed, but the site’s structure aligns with credential harvesting infrastructure designed to exfiltrate sensitive wallet data. Infrastructure analysis reveals the domain was registered on May 21, 2026, through Dynadot Inc, a registrar frequently abused for malicious registrations. The domain is currently flagged by 19 out of 95 security vendors on VirusTotal, indicating a high-confidence detection rate. It appears on three security blocklists and is actively blocked by multiple browser-based security layers. The domain resolves to an IP address associated with bulletproof hosting providers, a common trait in phishing infrastructure. Google Safe Browsing (GSB) classifies this domain as malicious, further corroborating its fraudulent nature. As of the latest verification, tronliink.cyou remains active, posing an ongoing risk to TRON ecosystem users. The domain has not been taken down by the registrar or hosting provider, despite its presence on multiple threat intelligence feeds. Users who interacted with this site are advised to immediately transfer assets to a new wallet, revoke any connected dApp permissions, and monitor for unauthorized transactions. The remaining risk is classified as high due to the domain’s persistence, brand impersonation tactics, and direct targeting of cryptocurrency credentials.