trx200[.]cc

Analysis indicates that trx200.cc is an active infrastructure used for brand impersonation of Binance. The domain was registered on 2025-11-01 through Gname.com Pte. Ltd. and resolves to the IPv4 address 154.12.45.23, which is allocated to AS979 NetLab Global in the United States. DNS is served by a.share-dns.com, a8.share-dns.com, b.share-dns.net, and b8.share-dns.net. The web server reports HTTP 200 responses, runs Nginx, and employs HTTP/3, HSTS, Google Analytics, and W3Counter tracking. The site presents the title “TRON Energy | TRX Energy Rental Service,” suggesting a crypto‑related lure, and is classified as a crypto scam that impersonates Binance. The SSL certificate is issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36, confirming a valid TLS handshake. VirusTotal scans show eight of ninety‑five security vendors flagging the domain, and the site is listed on a security blocklist and has been blocked by PhishDestroy. The Gridinsoft trust score of 0/100 further reinforces the malicious assessment. While the page content has not been inspected, the combination of brand impersonation, malicious hosting characteristics, and external detections warrants immediate defensive action. Organizations should add trx200.cc and its resolving IP 154.12.45.23 to web‑filter deny lists, monitor DNS queries for the associated nameservers, and enforce TLS inspection to capture any credential exfiltration attempts. Continuous threat‑intel feeds should be used to track any new indicators related to this infrastructure.