# buytrx.nl — SUSPICIOUS

> PhishDestroy identifies buytrx.nl as a deceptive crypto phishing site flagged by 3/95 VirusTotal scanners. View the full report for mitigation steps.

## Summary
PhishDestroy identifies buytrx.nl as a domain engaged in cryptocurrency-related phishing with an elevated risk level. This website impersonates legitimate crypto services to steal digital assets by tricking users into entering private keys or seed phrases on fraudulent login pages.

This domain shows multiple red flags across security platforms. VirusTotal lists 3 out of 95 security vendors flagging buytrx.nl as malicious. The domain is registered through Internet Domain Service BS Corp., resolving to IP 104.21.59.23 with a Let’s Encrypt SSL certificate. The domain was created on March 23, 2026, which is a recently registered domain—a common tactic among phishing operators to exploit newly established domains before blocklists catch up. The presence of an SSL certificate does not indicate legitimacy; phishers frequently abuse free certificates to appear trustworthy.

To avoid falling victim to this crypto phishing attack, do not enter any private keys, wallet passwords, or seed phrases on this site. Always navigate directly to official websites using verified bookmarks or search engines—never through links in emails, social media, or ads. Verify domain spelling carefully, as attackers often use subtle misspellings (e.g., buytrx.nl vs. buytrx.com). Use browser extensions like uBlock Origin or Bitdefender TrafficLight to block known phishing sites. Report any interaction with this domain to your local cybercrime unit and consider scanning your device for malware using reputable antivirus tools. If you suspect exposure, immediately transfer your assets to a new wallet using a clean device.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-23 00:00:00
- Registrar: Internet Domain Service BS Corp.
- IP: 104.21.59.23

## Detection Status
- VirusTotal: 3 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/815a3659-78f8-4bc5-a25e-0cf214d1e92b
- PhishDestroy: https://phishdestroy.io/domain/buytrx.nl/
- LLM endpoint: https://phishdestroy.io/domain/buytrx.nl/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/buytrx.nl/
Last updated: 2026-03-25