tronlink[.]now

Analysis of the domain tronlink.now, which was created on 29 November 2025 and is registered through NameCheap, Inc., shows multiple indicators of a cryptocurrency brand‑impersonation campaign targeting Ethereum users. The site’s page title, “TronLink 钱包 | 超过 10,000,000 全球用户的可靠选择,” references the TronLink wallet but the intelligence flags the domain as impersonating the Ethereum brand, suggesting a likely attempt to lure users under the premise of a trusted crypto wallet. The domain resolves to the IPv4 address 154.12.32.39, an IP hosted in the United States and assigned to AS35251 NetLab Global. No SSL certificate is present, meaning the site operates without HTTPS encryption.

Nameserver records point to dns1.registrar-servers.com and dns2.registrar-servers.com, typical of domains registered with NameCheap. Security‑vendor scanning on VirusTotal returned a single positive detection out of 93 scanners, and the domain appears on one external blocklist. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the suspicion of malicious intent. PhishDestroy has already taken the site offline, and the current status is reported as “taken offline.” Despite the offline state, the historical presence of the domain, combined with the low trust score and the brand‑impersonation label, warrants continued monitoring.

Defenders should add tronlink.now to DNS‑blocking policies, incorporate the IP address 154.12.32.39 into network‑level deny lists, and watch for future registrations that reuse the same registrar, nameservers, or hosting provider. Because the site lacks an SSL certificate and its content beyond the page title has not been publicly captured, the precise phishing vectors remain uncertain; however, the existing evidence suggests the domain was intended to deceive Ethereum users seeking wallet services.