# buytrx.vip — SUSPICIOUS

> buytrx.vip is linked to generic phishing with low risk. Avoid interacting and stay vigilant against suspicious emails or links.

## Summary
PhishDestroy identifies buytrx.vip as a low-risk generic phishing domain. The threat is deemed minimal but warrants caution due to its phishing nature.

This domain was registered on February 21, 2026, and is currently offline. It appeared on three security blocklists and was flagged by 2 out of 95 VirusTotal vendors, indicating some malicious activity prior to takedown.

Users should avoid any interaction with buytrx.vip and remain cautious of unsolicited communications. The domain is no longer active, reducing immediate risk but vigilance is advised for related phishing attempts.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: alive (HTTP 530)
- Page title: Buy TRX for USDT

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- IP: 2a06:98c1:3121::3
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- SSL Issuer: WE1

## Detection Status
- VirusTotal: 2 vendors flagged
  Vendors: ["SOCRadar", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["PhishDestroy", "MetaMask"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019b1071-44ab-705e-87da-df284a575b2b.png
- PhishDestroy: https://phishdestroy.io/domain/buytrx.vip/
- LLM endpoint: https://phishdestroy.io/domain/buytrx.vip/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/buytrx.vip/
Last updated: 2026-03-19