get-tronlink[.]com

On July 25, 2026, the domain get-tronlink.com was observed to be offline but retains indicators of a malicious infrastructure. The site previously served a page titled “TronLink Wallet | Trusted by over 10,000,000 users worldwide”, which aligns with the listed scam type “Crypto Scam”. The domain resolves to the IP address 172.67.184.24, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Hosting is provided through Cloudflare, with HTTP/3 enabled and the TLS certificate issued by Google Trust Services under the WE1 root. The registrar listed is Gname.com Pte. Ltd., and the authoritative nameservers are ian.ns.cloudflare.com and surina.ns.cloudflare.com.

The domain was created on February 21, 2026, indicating a relatively recent registration. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. The domain appears on one public blocklist, PhishDestroy, and was flagged by 10 of 93 security vendors on VirusTotal. No additional public threat‑intel feeds were referenced. The combination of a newly registered domain, low trust score, presence on a phishing blocklist, and multiple vendor detections suggests the site was used to lure victims into a counterfeit TronLink wallet interface, likely to harvest private keys or credentials.

Because the site is currently offline, active mitigation is limited to ensuring that any cached or historic references are blocked at the network perimeter. Defensive actions should include adding the domain and its resolving IP to blocklists, updating URL filtering policies, and monitoring for any resurgence of the same infrastructure or similar domain registrations. Analysts should also watch for new domains that resolve to the same Cloudflare IP range and exhibit the same page title or SSL certificate characteristics.