tronllnk[.]com[.]cn

PhishDestroy’s seed 39955c analysis confirms tronllnk.com.cn is an active crypto-draining domain masquerading as the legitimate TronLink wallet portal. Users who interact with this fraudulent login page risk unauthorized transfers of TRX and TRC-20 tokens to attacker-controlled wallets. The domain leverages a deceptive visual clone of TronLink’s interface to harvest credentials and seed phrases, then initiates silent on-chain transactions to siphon funds. Blockchain explorers have already flagged multiple outflow addresses linked to this campaign, indicating coordinated theft in progress. This domain presents a critical threat due to its low detection footprint and professional replication of TronLink’s branding. VirusTotal currently shows 0 detections out of 95 engines as of today, suggesting evasion of signature-based defenses. It resolves to IP 34.228.224.102, hosted on AWS infrastructure operated by 浙江贰贰网络有限公司, and secured with a Let’s Encrypt SSL certificate issued May 4, 2026. The domain’s recent creation and clean WHOIS history indicate opportunistic registration timed to coincide with Tron ecosystem growth, maximizing exposure before takedown. Users who visited tronllnk.com.cn should immediately revoke any connected TRC-20 token approvals via TronLink’s official dApp browser or wallet settings. Transfer remaining assets to a newly generated address on a hardware wallet or clean software instance. Scan devices with PhishDestroy for dormant malware and rotate seed phrases used on fraudulent sites. Organizations should add 34.228.224.102 and *.tronllnk.com.cn to network blocklists, while TronLink users should verify all links via their official app or website tronlink.org before any input.