buy-trx[.]shop

PhishDestroy identifies buy-trx.shop as an active cryptocurrency phishing domain designed to impersonate legitimate TRON (TRX) services. The site promotes a fraudulent USDT-to-TRX conversion service under the false pretense of 'TRON Energy Purchase,' leveraging deceptive branding to lure victims into depositing cryptocurrency funds. Current evidence confirms the domain remains operational, with no takedown actions initiated at this time. This constitutes a direct threat to individuals seeking cryptocurrency exchange services, particularly those unfamiliar with TRON’s legitimate platforms.

This domain was flagged by 3 of 95 VirusTotal security vendors, indicating a lack of immediate detection despite its active campaign. Registered through Turingsign Inc., the domain resolves to IP address 172.67.138.10 and was created on April 01, 2026, suggesting a recent and hastily deployed operation. The domain’s SSL certificate, issued by Let’s Encrypt, provides a false sense of legitimacy, while its short operational history and low detection rate highlight its stealthy nature. No known blocklists currently include this domain, further increasing its potential reach among unsuspecting users.

The current status of buy-trx.shop remains active, with no visible mitigation efforts in place. Users are strongly advised to avoid interacting with this domain and to verify the authenticity of TRON-related services through official channels. Security teams should monitor for similar domains and consider proactive blocking of the associated IP and SSL certificate. Additionally, cryptocurrency users should exercise extreme caution when engaging with third-party exchange services and prioritize platforms with established reputations and multi-layered security measures. Reporting this domain to relevant authorities and threat intelligence platforms can aid in broader detection and takedown efforts.