tronlilnk[.]cn

PhishDestroy identifies tronlilnk.cn as an active crypto drainer impersonating the legitimate TronLink wallet extension. The domain poses an immediate threat to cryptocurrency users by tricking victims into connecting their wallets to malicious smart contracts, enabling unauthorized fund transfers. This scam mirrors legitimate TronLink interfaces to harvest private keys and seed phrases, with stolen assets typically redirected to mixing services within minutes of compromise. Technical analysis confirms the domain resolves to 192.238.201.88 and employs a Let's Encrypt SSL certificate, adding false legitimacy to phishing pages.

This domain was flagged with 0 detections out of 95 VirusTotal scanners as of the investigation date, indicating it evades most automated detection systems. The domain was registered through 杭州爱名网络有限公司 on May 04, 2026, a recently created domain with no established reputation. The combination of fresh registration, low detection rates, and active hosting infrastructure suggests this is a short-lived campaign designed to maximize victim engagement before takedown. Threat intelligence shows similar domains in this campaign follow a pattern of targeting Tron ecosystem users through social media and messaging platforms.

Users who visited tronlilnk.cn should immediately disconnect their wallets, revoke any connected smart contracts, and transfer remaining funds to a new wallet. Generate new seed phrases and private keys for all affected accounts. Scan devices for malware with reputable antivirus software, as crypto drainers often deploy keyloggers or clipboard hijackers. Report the domain to PhishDestroy and your wallet provider, and warn others in Tron communities about this active threat. Always verify wallet URLs against official sources before entering sensitive information or connecting extensions.