tronlinkweb3[.]com

This domain, tronlinkweb3.com, poses a direct threat as a crypto asset drainer targeting users of the TronLink wallet. Analysis indicates the site is designed to mimic legitimate TronLink web interfaces, tricking visitors into connecting their wallets and authorizing malicious transactions. Once connected, the site deploys smart contract-based scripts to siphon cryptocurrency holdings without further user consent, a tactic increasingly observed in decentralized finance (DeFi) phishing campaigns. Infrastructure analysis reveals multiple indicators of malicious intent. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk registrations. It resolves to the IP address 188.114.97.3, hosted on AS13335, and is currently flagged by 11 out of 95 security vendors on VirusTotal. Additionally, the domain appears on one security blocklist, and its SSL certificate, issued by Google Trust Services, does not mitigate the underlying threat. The page title, 'Suspected phishing site | Cloudflare,' further suggests protective measures have been triggered by the hosting infrastructure. Users who have visited tronlinkweb3.com or interacted with its content should immediately revoke any wallet authorizations granted to the site. This can be done through the connected wallet’s interface by reviewing and revoking permissions for unknown or suspicious contracts. Affected individuals should also transfer remaining assets to a new, secure wallet and monitor transaction histories for unauthorized activity. No further interaction with the domain should occur, and any credentials or recovery phrases entered on the site must be considered compromised. Security teams are advised to update blocklists to include this domain and its associated IP address to prevent further exposure.