tronlink-token[.]app

Analysis as of July 24, 2026 indicates that the domain tronlink-token.app is associated with a high‑risk brand‑impersonation campaign targeting Coinbase users. The domain resolves to IP address 188.114.96.3, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. Registration data show the domain was created on February 21, 2026 through the registrar Gname.com Pte. Ltd., and the authoritative name servers are pola.ns.cloudflare.com and todd.ns.cloudflare.com. No TLS certificate was observed, and the site is currently taken offline, which limits immediate content inspection.

Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal recorded 14 detections out of 93 scanning engines, and the domain appears on three external blocklists. Additional defensive products, including PhishDestroy, MetaMask, and SEAL, have listed the domain as malicious. The page title retrieved from the site reads “Coinbase - 购买和出售比特币、以太坊以及其他可靠币种”, confirming the use of Coinbase branding.

The campaign is classified as a crypto‑scam that impersonates Coinbase, but the exact payload or credential‑harvesting mechanism remains unknown due to the offline status. Defenders should continue to block the domain at the DNS and network layers, monitor for any resurgence of the host IP, and update endpoint and browser protection tools with the observed indicators of compromise. Further investigation is recommended if the site returns online, focusing on HTTP response codes, potential redirection behavior, and any embedded scripts that could exfiltrate user credentials.