trolink[.]cc

Analysis of the domain trolink.cc, created on 25 June 2025 and registered through Gname.com Pte. Ltd., shows multiple indicators of a malicious crypto‑related operation. The site resolves to the IP address 43.163.105.10, which is hosted in Singapore under ASN 132203 at a Tencent‑owned building. The infrastructure has been taken offline, but historical data indicate that the domain was listed on at least one security blocklist and is currently blocked by PhishDestroy. The Gridinsoft trust score of 0 / 100 further reinforces the low credibility of the hosting environment.

VirusTotal records reveal that 8 of 93 scanning engines flagged the domain, demonstrating that automated detection tools have identified suspicious characteristics. The SSL certificate is labeled “R11”, a classification that typically denotes a low‑trust or self‑signed certificate, which aligns with the overall risk profile. The observed page title, “TronLink 钱包 | 超过 10,000,000 全球用户的可靠选择”, references the TronLink wallet, yet the listed brand target is Ethereum, indicating a likely brand‑impersonation tactic aimed at Ethereum users. The scam type is explicitly identified as a “Crypto Scam”.

Because the domain is offline, direct content analysis was not possible, leaving the exact phishing page layout, credential‑capture mechanisms, or additional payloads unknown. Defenders should therefore treat any DNS resolution to 43.163.105.10 as malicious, add trolink.cc to internal blocklists, and monitor for any resurgence of the domain or related subdomains. Network sensors should flag outbound connections to the associated IP, especially from endpoints handling cryptocurrency wallets or private keys. Continuous threat‑intel feeds should be consulted for any future re‑registration of the domain, and organizations should educate users about unsolicited requests purporting to involve Ethereum or TronLink services, stressing verification of legitimate URLs before entering credentials.