Our automated security review marked tr.ee as suspicious. Several warning signs were detected; it may still turn out legitimate, but you should verify it through independent channels before trusting it with money or credentials.

Is tr.ee safe to use?

tr.ee currently scores 30/100 on our trust scale. We found enough warning signals to recommend caution. Verify the site through independent channels before entering credentials or money.

Does tr.ee have a valid SSL certificate?

Yes. tr.ee presents a valid TLSv1.2 certificate issued by Let's Encrypt · YR2, expiring in 64 days. Note that SSL only encrypts the connection — it does not guarantee that the site itself is trustworthy.

Has tr.ee been flagged by antivirus engines?

3 out of 92 antivirus engines in our malware network flagged tr.ee as malicious or suspicious (2 outright malicious). Even one detection is a meaningful signal.

Is tr.ee on any phishing or malware blacklists?

No. tr.ee is not currently listed on the major browser blocklist feeds that modern browsers use.

Where is tr.ee hosted?

tr.ee resolves to an IP operated by Fastly, Inc. in US (usage type: Content Delivery Network). Hosting location alone doesn't make a site good or bad, but unusual geography for a brand's claimed country is one of many signals we weigh.

Is tr.ee a well-known website?

Yes. tr.ee sits in the global top-100k on Cloudflare Radar, which means it has substantial real-world traffic. That does not automatically make it safe, but established brands almost always rank here and throwaway scam domains almost never do.

How often is the tr.ee report updated?

This is a permanent record of the scan run on June 27, 2026. The verdict and evidence above reflect that scan and do not change on their own. If circumstances around tr.ee have changed, MalwareTips staff can run a fresh scan, which re-runs every check from scratch and publishes an updated report.

Security Review

Is tr.ee legit or a scam?

Our verdict:Suspicious· 30/100

SafeSuspiciousDangerous

A Linktree profile using the tr.ee shortener that redirects users to external domains flagged for phishing and suspicious content.

Top reasons

Multiple antivirus engines (Criminal IP, Heimdal Security) flag the page as malicious or phishing.The profile loads scripts from high-risk external domains like apk-hero.com.The page content uses clickbait titles in Arabic to encourage users to click suspicious redirects.

tr.eeScanned 8h ago

Post Facebook

Trust score

SUSPICIOUS

Heuristics 1·MT 45

Category tags

phishing#phishing85% MT confidence

Technical red flags (1)

3 of 92 engines flagged

Warning signals (1)

Redirects to another domain

Positive signals (3)

Not on major blacklists Encrypted connection Clean server reputation

These checks passed — but they don't clear the site. A clean antivirus result, valid SSL, and a calm server only mean it isn't hosting malware; they say nothing about whether the business is real. This verdict is based on the site's conduct and content, not a malware detection.

View density

Analysis Summary

Threat Intelligence

3/92

Engines flagged this URL

Domain Age

—

Registration date unknown

MT Intelligence

Suspicious

Moderate likelihood · 85% confidence

SUSPICIOUS

Warning signs detected

3 of 92 antivirus engines flag this page (2 outright malicious). Several risk indicators suggest caution. This site might be legitimate — but treat it as unverified until you can independently confirm.

Website Preview

LIVE RENDER

tr.ee

1Page is in Arabic; visual cues neutral

Automated page render — captured in a safe sandbox. What an ordinary visitor would see when loading the site. See full visual analysis →

Visual Screenshot Analysis

We capture a fresh screenshot of the live page and ask a vision model to look for scam visual patterns — fake trust badges, countdown timers, overlay pop-ups, and visual clones of legitimate brands.

/ 100

High visual risk

Visual red flags detected in the screenshot

The page is a standard Linktree profile in Arabic; while the content cannot be fully evaluated, the visual structure does not exhibit typical scam patterns.

Visual risk50/100

What our vision model saw

3 signals

Page is in Arabic; visual cues neutral

Standard Linktree profile layout with social links

No obvious scam indicators or urgency tactics visible

MT Intelligence

Advanced threat intelligence

MT Security Analyst

Moderate scam likelihoodengineMT · Guardiantrust45/100

MT AgentLive web researchVisual inspectionNetwork correlation

Confidence

The domain tr.ee is the official short-link service for Linktree, a legitimate Australian company. However, our analysis shows that this specific profile, @darkmirleft, is being used to host links that redirect to high-risk external domains like apk-hero.com and pookri.com. Criminal IP and Heimdal Security have flagged the page for phishing and malicious activity. While the infrastructure is professional, the content follows a known pattern where scammers use trusted link-in-bio tools to bypass security filters. We have also identified reports of this specific shortener being abused in malware campaigns.

Full dossier

Analysis complete

Page Content

The page is a standard Linktree profile titled '@darkmirleft' with content written in Arabic. It features several buttons that claim to lead to videos, but these links point to external domains rather than social media platforms.

Infrastructure

The site is hosted on a high-reputation IP address (151.101.2.133) belonging to a major content delivery network. It uses a valid Let's Encrypt SSL certificate. However, the page loads scripts from several suspicious external domains including apk-hero.com and mobirul.com.

Domain History

The tr.ee domain is owned by Linktree Pty Ltd, an established business registered in Australia since 2015. While the domain itself is reputable, it is frequently exploited by third parties to create short-lived redirect links for phishing.

Web Reputation

Our antivirus network shows flags from Criminal IP (phishing), Heimdal Security (malicious), and DNS8 (suspicious). Independent research confirms that tr.ee links have been used in the past to distribute the Rhadamanthys stealer malware and facilitate marketplace fraud.

Risk Factors

Multiple antivirus engines (Criminal IP, Heimdal Security) flag the page as malicious or phishing.
The profile loads scripts from high-risk external domains like apk-hero.com.
The page content uses clickbait titles in Arabic to encourage users to click suspicious redirects.
Documented history of the tr.ee shortener being abused in malware and credential-theft campaigns.
Lack of direct contact information or verified social media links on the profile.

Positive Signals

The domain tr.ee is the official shortener for Linktree, a legitimate Australian company.
The site uses a valid SSL certificate and is hosted on a professional CDN.
The domain has a high global traffic rank, indicating it is a widely used service.

AI Recommendation

Do not click the links on this profile or download any files it suggests. While Linktree is a real service, this specific page is being used to redirect users to dangerous external websites.

Scam network detected

3 linked domains correlated

The profile is linked to a network of domains often associated with suspicious mobile downloads and ad-wrappers.

apk-hero.commobirul.compookri.com

Next-gen fraud intelligence

Evidence-backedCross-checked

Web Research Findings

Our live research agent queries scam-report databases, consumer-review sites, news coverage, and general web search for tr.ee, then cross-checks business-registration records and look-alike domain patterns. Everything below is pulled from what it actually found.

Business registration

Active · Australia

Site traces back to an actively registered business.

Clone check

Not a clone

No well-known site's layout or branding detected here.

Typosquat check

No look-alike match

The domain doesn't resemble any well-known brand's spelling.

Web mentions

2 scam reports · 1 positive

Key findings

7 headline facts from open-web research

tr.ee is the official link shortener and QR code generator service from Linktree (linktr.ee), marketed as 'Custom Trusted Short Links by Linktree for Any URL'.
Operated by Linktree Pty Ltd (ABN 68 608 721 562), an active Australian private company registered on 13 October 2015 in Collingwood, Victoria.
Features include unlimited short links with no expiration, click analytics (geo, referrer, device), and integration with Linktree's link-in-bio tools.
The scanned page title "@darkmirleft | Linktree" aligns with Linktree profile pages; @darkmirleft appears to be a content creator (horror/mystery themes on Instagram/TikTok).
tr.ee short links have been abused in phishing and scam campaigns (e.g., Rhadamanthys stealer malware via fake copyright notices; Unreal Engine marketplace fraud).
Trustpilot shows a page for tr.ee with only 3 reviews (average score around 3.5/5); no major dedicated scam reports against the service itself.
Company maintains terms, privacy policy, and violation reporting at linktr.ee/s/ paths; acknowledges Wurundjeri people of the Kulin Nation.

Scam reports (2)

Direct quotes from public scam databases, forums, and news.

Unreal Engine Forumsopen
"the scammer’s link http://tr.ee/sketchfab"
Cybereasonopen
"The “Evidence of infringement.pdf” was a hyperlink that led to a URL shortened link of https://tr[.]ee/a3IIBd ... that resolved through a chain of redirections to final destination of https://kiteaero[.]net"

Business registration

Status: active · Australia

Linktree Pty Ltd (ABN 68 608 721 562), registered 13 Oct 2015, Australian Private Company, GST registered, headquarters in Collingwood, VIC

Research summary

Narrative write-up from our AI analyst, grounded on the facts above

Our research confirms tr.ee is the official short-link service for Linktree, an active Australian company registered in 2015. However, we found reports on the Unreal Engine Forums and from security researchers at Cybereason detailing how scammers use these links to hide malicious destinations, including malware like the Rhadamanthys stealer. While the service is real, this specific link is part of a high-risk redirection chain.

Antivirus Engines

Detection matrix · live

3 engines flagged this URL

We cross-check every URL against our antivirus network of 92 malware and blacklist engines. Each detection is listed below by engine name — even a single hit is a meaningful signal.

2Malicious1Suspicious57Harmless92Engines

of 92

Criminal IP

Malicious· phishing

Heimdal Security

Malicious· malicious

DNS8

Suspicious· suspicious

3 antivirus engines flagged this URL. Even a single detection is a meaningful signal — treat this site with extra caution and avoid entering credentials, payment info, or downloading any files.

Security Scans

Blacklist Check

Not flagged on major threat lists

Checked against the major public blocklists used by browsers and security tools — no hits.

Contact Verification

We fetched the page and looked for real-world contact details. Legitimate businesses almost always publish an email on their own domain, a phone number, and a postal address. Scam shops usually don't.

What We Found

No clear contact details on the page

Emails on site's domainNone

Phone numbersNone

Postal addressNot listed

Linked social profiles0

Signal Summary

Several contact red flags

No contact email found anywhere on the page.
No phone number listed on the page.
No postal address visible on the page.

Domain & Encryption

Encryption Certificate

StatusValid

ProtocolTLSv1.2

IssuerLet's Encrypt · YR2

ExpiresAug 30, 2026 (64d)

Self-signedNo

Hosting & Technology

HostingFastly, Inc.

Server locationUS

Web servernginx

PopularityTop 100k worldwide

Redirect Chain

Hops

Cross-domain

Yes

Lookalike

Punycode

1302https://tr.ee/aT1KEu2LLb
2200https://linktr.ee/youness.afrehati?lt_utm_source=lt_share_link#574454808cross-domain

Server Reputation

Abuse Intelligence

Confidence score0%

Reports on file5

ISPFastly, Inc.

Usage typeContent Delivery Network

Proceed with caution

Our automated review flagged enough risk that you should treat this site as unverified.

Treat tr.ee as unverified
Do not enter credentials or send money until you have independently verified the business.
Verify the business through independent channels
Check the company's social profiles, registry records, and search for recent news or reviews that are not hosted on the site itself.
Never use irreversible payment methods
Crypto, gift cards, wire transfers, and cash apps offer zero buyer protection. Use a credit card or PayPal if you must pay.
Share your experience
If you have additional context, drop a comment below or post on the MalwareTips forum.
Open

Reputation Sources

How this domain rates across independent threat-intelligence and blocklist providers.

Google Safe Browsing

Not listedCheck ↗

VirusTotal

ListedCheck ↗

AbuseIPDB

Not listedCheck ↗

Also verify:Spamhaus ↗DNSBL / SURBL ↗PhishTank ↗

Referenced Domains

Outbound domains this page links to or loads resources from. Each links to its own security scan.

linktr.ee assets.production.linktr.ee ugc.production.linktr.ee api.consentjs.datagrail.io edge.browser-fp.production.linktr.ee fonts.googleapis.com fonts.gstatic.com iopalqoahxva.apk-hero.com dubrovnik.mobirul.com sofia.pookri.com

Safety FAQ

Common questions about this site, answered directly from the scan data above — so the answers always reflect the latest verdict on this page.

Our automated security review marked tr.ee as suspicious. Several warning signs were detected; it may still turn out legitimate, but you should verify it through independent channels before trusting it with money or credentials.
tr.ee currently scores 30/100 on our trust scale. We found enough warning signals to recommend caution. Verify the site through independent channels before entering credentials or money.
Yes. tr.ee presents a valid TLSv1.2 certificate issued by Let's Encrypt · YR2, expiring in 64 days. Note that SSL only encrypts the connection — it does not guarantee that the site itself is trustworthy.
3 out of 92 antivirus engines in our malware network flagged tr.ee as malicious or suspicious (2 outright malicious). Even one detection is a meaningful signal.
No. tr.ee is not currently listed on the major browser blocklist feeds that modern browsers use.
tr.ee resolves to an IP operated by Fastly, Inc. in US (usage type: Content Delivery Network). Hosting location alone doesn't make a site good or bad, but unusual geography for a brand's claimed country is one of many signals we weigh.
Yes. tr.ee sits in the global top-100k on Cloudflare Radar, which means it has substantial real-world traffic. That does not automatically make it safe, but established brands almost always rank here and throwaway scam domains almost never do.
This is a permanent record of the scan run on June 27, 2026. The verdict and evidence above reflect that scan and do not change on their own. If circumstances around tr.ee have changed, MalwareTips staff can run a fresh scan, which re-runs every check from scratch and publishes an updated report.

Final Verdict

Trust / 100

Final Verdict·tr.ee

SUSPICIOUS

This is a Linktree profile page that uses an official short-link service but contains links to external domains flagged for suspicious activity. While the platform itself is legitimate, the specific content on this profile is being used to redirect users to high-risk sites.

Do not click the links on this profile or download any files it suggests. While Linktree is a real service, this specific page is being used to redirect users to dangerous external websites.

AV engines

MT passes

Net signals

Scan another URL

Security review completemalwaretips.com/url-scan

Recently scanned

Other Suspicious reports

form.ivblockchain.com

Community review

User reviews & comments(0)

Share your experience — "Lost $200 on a fake checkout" is more useful than "Scam". Your review helps others avoid traps.

Loading…

Loading comments…

This report is generated automatically by combining threat intelligence, domain signals, and an AI security analyst. It is informational, not legal advice. Always use your own judgement before sharing personal information or money online.