# buy-trx.de — SUSPICIOUS

> buy-trx.de poses as a TRON (TRX) purchase portal, steals wallet logins, and currently avoids 95 VirusTotal scanners per seed 32b405. Stay away.

## Summary
PhishDestroy identifies buy-trx.de as an active credential-harvesting site disguised as a TRON (TRX) trading portal. The domain mimics legitimate crypto-exchanges to trick users into entering private keys or seed phrases, which are then sent to attacker-controlled servers rather than a real blockchain network. Unsuspecting visitors risk immediate loss of all funds stored in connected wallets.


This domain was flagged under seed 32b405 with zero detections on VirusTotal (0/95 engines) despite the obvious threat. It uses a publicly trusted Let’s Encrypt SSL certificate and resolves to Cloudflare IP 172.67.131.6, a common bulletproof fast-flux node used to hide origin infrastructure. Who-is records further reveal this domain was registered within the last 48 hours, indicating a brand-new trap rather than an established scam shop.


If you visited buy-trx.de: immediately close the tab, revoke any permissions granted to the site, transfer remaining funds to a brand-new wallet, and reset your device passwords. Scan for malware and enable two-factor authentication on every exchange or wallet you frequent. Report the domain to your local cyber-crime unit and to PhishDestroy’s automated takedown system using seed 32b405 so others remain protected.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: REGISTRAR_NOT_FOUND
- IP: 172.67.131.6

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/e89df55a-dddd-46ce-8535-01596a83a6dd
- PhishDestroy: https://phishdestroy.io/domain/buy-trx.de/
- LLM endpoint: https://phishdestroy.io/domain/buy-trx.de/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/buy-trx.de/
Last updated: 2026-03-31