bytrx[.]org

This domain, bytrx.org, was registered on July 4, 2025 and is currently active. The site presents a page titled “USDT to TRX Conversion & TRON Energy Purchase | Fast, Secure, Reliable” and claims to facilitate cryptocurrency transactions, directly impersonating the Bitget brand. The page title and the explicit mention of USDT, TRX, and TRON Energy indicate a cryptocurrency‑draining lure aimed at users familiar with Bitget’s services.

Infrastructure analysis shows the domain is hosted behind Cloudflare, resolving to IP address 172.67.131.240, which belongs to AS13335 Cloudflare, Inc. The DNS records use the Cloudflare nameservers carla.ns.cloudflare.com and justin.ns.cloudflare.com. TLS is provided by Google Trust Services using the WE1 certificate, and the site negotiates HTTP/3 via Cloudflare Browser Insights. An HTTP 301 redirect is observed, suggesting additional landing pages may be hidden behind the initial request.

Reputation signals are overwhelmingly negative. Gridinsoft assigns a trust score of 0 out of 100, while Scamadviser rates the domain at 46 out of 100. VirusTotal reports that 2 of 95 security vendors have flagged the domain, and the domain appears on a single security blocklist, where it is listed by PhishDestroy. The combination of a high‑risk classification, active status, and a brand‑impersonation tag for Bitget reinforces the likelihood that the site is used for credential harvesting or cryptocurrency theft.

Defenders should block bytrx.org at the DNS and proxy layers, monitor outbound traffic for connections to the Cloudflare IP 172.67.131.240, and enforce multi‑factor authentication for Bitget accounts to mitigate credential reuse. Continuous threat‑intel feeds should be consulted for any updates to the blocklist status, and any observed user reports of unsolicited Bitget‑related communications should be correlated with this domain. Swift containment will reduce the attack surface for this high‑risk impersonation campaign.