tronlinknft[.]org

The domain tronlinknft.org was registered on 21 February 2026 through NiceNIC International Group Co., Limited and immediately pointed to the Cloudflare‑owned address 188.114.97.3, which resides in the United States under ASN 13335. The authoritative name servers alberto.ns.cloudflare.com and teagan.ns.cloudflare.com confirm that the domain is hosted behind Cloudflare’s edge network, and the TLS certificate presented is issued by Google Trust Services under the WE1 trust profile, indicating a valid HTTPS endpoint. Access attempts return HTTP 403, and the only visible page title is “TronLink NFT Claims – Check Your Eligibility”, which aligns with the intelligence classification of an NFT‑related crypto drainer.

The site has been taken offline, and PhishDestroy currently lists it as blocked. It appears on a single security blocklist and has been flagged by six of ninety‑three VirusTotal scanners, reinforcing the suspicion of malicious intent. The combination of a recent registration, use of reputable infrastructure, a legitimate‑looking certificate, and the specific NFT‑claim phrasing suggests a deliberate attempt to lure cryptocurrency users into submitting private keys or authorising transfers.

At this stage, the exact payload or phishing kit employed has not been publicly disclosed, and no additional content has been captured. Defenders should continue to deny any network traffic to 188.114.97.3 associated with this domain, add tronlinknft.org to URL filtering and endpoint blocklists, and monitor for any emergent replicas that reuse the same page title or TLS certificate. Continuous re‑scanning on VirusTotal and inclusion in threat‑intel feeds are recommended to capture potential re‑activations.