trxog[.]org

This domain, trxog.org, poses a threat as a brand impersonation site designed to mimic Telegram’s platform. The page title USDT to TRX Conversie and TRON Energie Aankoop suggests it is a crypto drainer, aiming to trick users into connecting their cryptocurrency wallets or entering sensitive credentials under the false pretense of exchanging Tether (USDT) for TRON (TRX) or purchasing energy on the TRON network. By impersonating Telegram, the attackers exploit trust in a well-known messaging brand to lure victims into a fake service that likely drains funds or steals login details.

Technical analysis confirms the malicious nature of trxog.org. It resolves to IP address 188.114.96.3, which is associated with content delivery networks but used here for hosting phishing infrastructure. VirusTotal reports 2 out of 95 security vendors flag the domain, indicating limited but credible detection. The domain was created on February 21, 2026, through Internet Domain Service BS Corp., a registrar often linked to high-risk domains. It appears on 3 security blocklists and has a Gridinsoft trust score of 0 out of 100, meaning no trust is assigned. The site is now offline, but its registration and infrastructure indicate a deliberate campaign to deceive users.

If you visited trxog.org or interacted with it, take immediate action. Do not connect any cryptocurrency wallet or enter passwords, private keys, or recovery phrases. Scan your device with an updated antivirus tool to check for malware. Change passwords for any accounts you may have used on the site and enable two-factor authentication where possible. Monitor your crypto wallets for unauthorized transactions and consider moving funds to a new, secure wallet if you connected one. Report the domain to relevant authorities or security platforms to help block similar threats in the future.