# PhishDestroy domain threat record: buytrx.net

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/buytrx.net/
Machine-readable companion: https://phishdestroy.io/domain/buytrx.net/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-27 17:18:45 UTC
- Last availability or vendor check: 2026-10-28 00:30:51 UTC
- Stored record updated: 2026-10-28 00:30:51 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: TRON

## Stored infrastructure

- Observed IP address: 89.106.200.1
- Registrar in stored WHOIS data: TUCOWS.COM, CO.
- Registrar country in stored WHOIS data: KN
- Last stored HTTP status: 301
- Registration date in stored WHOIS data: 2026-09-29 06:25:54 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17e5e-66bc-7366-92b2-814d5db38d85/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/buytrx.net
- Certificate Transparency search: https://crt.sh/?q=%25.buytrx.net
- Web Archive lookup: https://web.archive.org/web/*/https://buytrx.net/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s automated assessment classifies buytrx.net as an impersonation phishing page referencing TRON. The recorded page title claims to provide USDT to TRX Swap and TRON Energy Rental services. PhishDestroy first observed the domain on 2026-10-27. The domain returned an HTTP 301 redirect on the checked date, ultimately forwarding to buytrx.hair.

How the scam works
Impersonation phishing pages mimic legitimate brands to trick users into entering credentials, transferring funds, or approving wallet permissions. These pages often advertise plausible services like token swaps to appear legitimate. Users who connect wallets or submit transaction approvals risk draining assets or exposing private keys.

Evidence
VirusTotal detected the domain as malicious once on 2026-10-27 with one vendor flagging it as phishing. External blocklists MetaMask and SEAL listed the domain on 2026-10-27. PhishDestroy’s internal blocklist includes buytrx.net as of 2026-10-27. Google Safe Browsing did not flag the domain on 2026-10-27. OTX recorded four pulses mentioning the domain on 2026-10-27; OTX pulses are mentions, not detections. Spamhaus DBL listed buytrx.net under the spam category on 2026-10-27.

Infrastructure
The domain was registered on 2026-09-29 through Tucows Domains Inc. and resolves to the recorded IP 89.106.200.1 in Enflow B.V. (NL). Nameservers are Njalla‑related. The recorded TLS certificate covers buytrx.net and is issued by Let’s Encrypt. The domain’s redirect chain on 2026-10-27 led from buytrx.net to trxlc.org and then to buytrx.hair.

What to do
Avoid connecting any wallet or entering credentials on this site. If you have already provided sensitive information, consider securing your accounts and monitoring for unauthorized activity. Organizations should block the domain and monitor network traffic for requests to its recorded IP address.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17e5e-66bc-7366-92b2-814d5db38d85/
Cloudflare Radar report: https://radar.cloudflare.com/scan/0c37f87b-2e06-44d2-96ee-c85e47f9d5ce
URLQuery report: https://urlquery.net/report/8652b5f8-723a-4e0f-8592-ed004d188d9b
Stored capture screenshot: https://i.ibb.co/zhPZ6dBb/f22192ff740c.png
Cloudflare Radar screenshot (2026-10-27T17:50:47Z): https://screenshots.phishdestroy.io/cf/0c37f87b-2e06-44d2-96ee-c85e47f9d5ce.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/8652b5f8-723a-4e0f-8592-ed004d188d9b.png
URLScan screenshot (2026-10-27T17:14:50Z): https://screenshots.phishdestroy.io/us/01a17e5b-6b51-7352-a4bb-fb2f0707225b.png
URLScan capture report: https://urlscan.io/result/01a17e5b-6b51-7352-a4bb-fb2f0707225b/
VirusTotal report: https://www.virustotal.com/gui/domain/buytrx.net
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=buytrx.net
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 20:14:18 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/zhPZ6dBb/f22192ff740c.png
  Captured: 2026-10-27 17:18:45 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a17e5e-66bc-7366-92b2-814d5db38d85.png
  Captured: 2026-10-27 17:18:45 UTC
  Source report: https://urlscan.io/result/01a17e5e-66bc-7366-92b2-814d5db38d85/
- URLScan · 2026-10-27: https://screenshots.phishdestroy.io/us/01a17e5b-6b51-7352-a4bb-fb2f0707225b.png
  Captured: 2026-10-27 17:14:50 UTC
  Source report: https://urlscan.io/result/01a17e5b-6b51-7352-a4bb-fb2f0707225b/
  SHA-256: 0609f892eb0b0c4de4ef9992a8330e4999495619ddd7e9b257018fb28ba3b073
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/0c37f87b-2e06-44d2-96ee-c85e47f9d5ce.png
  Captured: 2026-10-27 17:50:47 UTC
  Source report: https://radar.cloudflare.com/scan/0c37f87b-2e06-44d2-96ee-c85e47f9d5ce
  SHA-256: 57ff4dfd19cad35da106682f1fbdceb33e645c64a4da6d8c681593951fe79bb5
- URLQuery: https://screenshots.phishdestroy.io/uq/8652b5f8-723a-4e0f-8592-ed004d188d9b.png
  Source report: https://urlquery.net/report/8652b5f8-723a-4e0f-8592-ed004d188d9b
  SHA-256: 05a90f419cd821ad7b53de1dd3f160803007e2ceaec79264289ce9a518da5095

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T17:53:13Z",
        "uuid": "01a17e5e-66bc-7366-92b2-814d5db38d85",
        "scanned_at": "2026-10-27T17:18:11Z",
        "final_url": "https://buytrx.hair/",
        "status": 200,
        "redirected": "off-domain",
        "redirects": [
            {
                "to": "https://trxlc.org/",
                "from": "https://buytrx.net/",
                "status": 301
            },
            {
                "to": "https://buytrx.hair/",
                "from": "https://trxlc.org/",
                "status": 301
            }
        ],
        "ip": "172.67.197.201",
        "domains": [
            "plausible.io",
            "www.okx.com",
            "trxlc.org",
            "buytrx.net",
            "api.binance.com"
        ],
        "ips": [
            "104.18.43.174",
            "37.19.207.38",
            "172.67.197.201",
            "104.21.3.197",
            "89.106.200.1"
        ],
        "asns": [
            "13335",
            "60068",
            "209626"
        ],
        "countries": [
            "US",
            "NL"
        ],
        "link_domains": [
            "t.me"
        ],
        "social": [
            "https://t.me/buytrx9"
        ],
        "doc_hash": "0a89529395991fa575e553af1b93cf88e1117726076050f2872ee392dab08cd7",
        "script_hashes": [
            "797a3210efbcc786bfb34cb1b5ba73d034e1dfc53585d20e9e90cf23e70a57f0",
            "4250d53f0bc756ece2ddd690a008add1d7fdc887528c671f4dfe8d916d7787b7",
            "ef6a08178c9f2e90859d810aace35adc5ecbb33055085d85646a3a68391e64f6",
            "682a32e75a22fa6067b34c588f2dc4860b1c5ce24818bc1b8fb1d040ab21416e",
            "869be8e208ec165ef0098aa9d36b12522886e950c100cfbf0c0a3c35cbb59ea7",
            "58f99ff231ee4664bdd12c3c2eaf4262a713b3e8e8ee9a9c680d8e572c3cb215",
            "6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e",
            "e140e0ed25b96233fc9ae70e942e58e8be07a7e5231182371d5c39483467c3c4",
            "0d59e1ae4a3c566fb66a3816f42aafe7d58a467a8f95820697d2d1b850c6af36"
        ],
        "globals": [
            "webpackChunk_N_E",
            "__next_set_public_path__",
            "next",
            "__NEXT_DATA__",
            "__SSG_MANIFEST_CB",
            "__NEXT_P",
            "_N_E",
            "__NEXT_PRELOADREADY",
            "__MIDDLEWARE_MATCHERS",
            "__BUILD_MANIFEST",
            "__SSG_MANIFEST",
            "__BUILD_SALT__",
            "APP_STATE",
            "openWalletModal",
            "closeWalletModal",
            "showWaiting",
            "updateWaiting",
            "hideWaiting",
            "showToast",
            "showTxHelp",
            "hideTxHelp",
            "plausible"
        ],
        "tls": {
            "san": [
                "buytrx.hair",
                "*.buytrx.hair"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "buytrx.hair",
            "protocol": "QUIC",
            "valid_to": "2026-12-31T20:56:33Z",
            "valid_from": "2026-10-02T19:58:51Z"
        },
        "domain_age_days": 84,
        "apex_age_days": 84,
        "tls_age_days": 24,
        "tls_valid_days": 90,
        "requests": 39,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T17:53:16Z",
        "uuid": "0c37f87b-2e06-44d2-96ee-c85e47f9d5ce",
        "scanned_at": "2026-10-27T17:50:47Z",
        "final_url": "https://buytrx.hair/",
        "status": 200,
        "redirected": "off-domain",
        "history": [
            {
                "url": "https://buytrx.net/",
                "status": 301
            },
            {
                "url": "https://trxlc.org/",
                "status": 301
            },
            {
                "url": "https://buytrx.hair/",
                "status": 200
            }
        ],
        "dom_hash": "f5d6a6d929733b56abae486e062ad92310719c5cf8a2cfc076b84c29d598c711",
        "doc_hash": "0a89529395991fa575e553af1b93cf88e1117726076050f2872ee392dab08cd7",
        "phishing_v2": [
            "phishing"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "buytrx.hair",
                "type": "A",
                "value": "172.67.197.201"
            },
            {
                "name": "buytrx.hair",
                "type": "A",
                "value": "104.21.60.148"
            },
            {
                "name": "buytrx.hair",
                "type": "AAAA",
                "value": "2606:4700:3036::ac43:c5c9"
            },
            {
                "name": "buytrx.hair",
                "type": "AAAA",
                "value": "2606:4700:3036::6815:3c94"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.21",
        "whois": {
            "registrar": "NameSilo, LLC",
            "created": "2026-08-04T16:06:26Z",
            "updated": "2026-08-10T10:41:00Z",
            "expires": "2027-08-04T23:59:59Z",
            "nameservers": [
                "maleah.ns.cloudflare.com",
                "miles.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T20:10:07Z",
        "analysis_at": "2026-10-27T18:05:27Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 1,
            "suspicious": 0,
            "undetected": 36
        },
        "detections": {
            "SOCRadar": "phishing"
        },
        "reputation": 0,
        "popularity": {
            "Alexa": 256484,
            "Statvoo": 782122
        },
        "registrar": "Tucows Domains Inc.",
        "created": "2026-09-29T08:25:54Z",
        "expires": "2027-09-29T08:25:54Z",
        "updated": "2026-09-29T08:26:34Z",
        "first_seen": "2025-07-14T03:03:23Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "2-can.njalla.in"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "3-get.njalla.fo"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "1-you.njalla.no"
            },
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "you.can-get-no.info",
                "value": "1-you.njalla.no"
            },
            {
                "ttl": 900,
                "type": "A",
                "value": "89.106.200.1"
            }
        ],
        "dns_at": "2026-10-27T18:11:02Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "buytrx.net"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6df52ab8802fef9c4f7352982558d6a55bd",
            "sha256": "0bf1baefbde3c42650ce05441a1a6663f6bb31e9aacfc1da9f9364fc1f43cb5f",
            "valid_to": "2026-12-11T11:56:31Z",
            "valid_from": "2026-10-27T11:56:32Z"
        },
        "whois": {
            "registrar": "Tucows Domains Inc.",
            "registrar_iana_id": "69",
            "registrar_url": "http://www.tucows.com",
            "created": "2026-09-29T08:25:54Z",
            "updated": "2026-09-29T08:26:34Z",
            "expires": "2027-09-29T08:25:54Z",
            "status": [
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "maleah.ns.cloudflare.com",
                "miles.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited",
                "client update prohibited"
            ],
            "events": {
                "expiration": "2027-09-29T08:25:54Z",
                "last changed": "2026-10-27T12:47:51Z",
                "registration": "2026-09-29T08:25:54Z",
                "last update of RDAP database": "2026-10-27T14:19:43Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T17:30:59Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "buytrx.net"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2023-03-29T11:30:11Z",
            "first": "2012-09-21T23:52:22Z",
            "changes": 2,
            "days_archived": 5,
            "scans_per_day": 0,
            "avg_page_bytes": 4279
        },
        "social_tags": {
            "title": "USDT to TRX Swap · TRON Energy Rental | Fast · Secure · Decentralized",
            "themeColor": "#1c0f2a",
            "description": "USDT to TRX Swap · TRON Energy Rental | Fast · Secure · Decentralized"
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 301,
            "timings": {
                "dns": 38,
                "tls": 114,
                "wait": 10,
                "connect": 6,
                "download": 0
            },
            "response_ms": 168
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 2031,
            "co2_grams": 0.0001,
            "cleaner_than": 95
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "185.193.124.34",
                    "host": "2-can.njalla.in"
                },
                {
                    "ip": "185.193.124.2",
                    "host": "1-you.njalla.no"
                },
                {
                    "ip": "95.215.19.5",
                    "host": "3-get.njalla.fo"
                }
            ],
            "zone": "buytrx.net"
        },
        "location": {
            "ip": "89.106.200.1",
            "asn": "209626",
            "org": "Enflow B.V.",
            "city": "Alphen aan den Rijn",
            "country": "NL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2"
        },
        "dns": {
            "A": [
                "89.106.200.1"
            ],
            "NS": [
                "2-can.njalla.in",
                "3-get.njalla.fo",
                "1-you.njalla.no"
            ],
            "SOA": "{\"nsname\": \"1-you.njalla.no\", \"hostmaster\": \"you.can-get-no.info\", \"serial\": 2026102712, \"refresh\": 21600, \"retry\": 7200, \"expire\": 1814400, \"minttl\": 3600}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "89.106.200.1",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://buytrx.net",
                "https://trxlc.org/",
                "https://buytrx.hair/"
            ],
            "count": 2
        },
        "whois": {
            "registrar": "Tucows Domains Inc.",
            "created": "2026-09-29T08:25:54Z",
            "updated": "2026-10-27T12:47:51Z",
            "expires": "2027-09-29T08:25:54Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp",
                "clientUpdateProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "1-you.njalla.no",
                "2-can.njalla.in",
                "3-get.njalla.fo"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8"
            }
        }
    }
}
```