# tronbuy.org — SUSPICIOUS

> tronbuy.org is a TRON (TRX) phishing site flagged by 0 of 95 VirusTotal vendors. Check the full report for detailed threat indicators and safety recommendations.

## Summary
PhishDestroy identifies tronbuy.org as an active cryptocurrency phishing domain currently under investigation for generic phishing tactics targeting TRON (TRX) users.

This domain, registered through Internet Domain Service BS Corp, resolves to IP 104.21.48.230 and was created on April 04, 2026. The site uses a Let’s Encrypt SSL certificate and currently shows 0 of 95 detections on VirusTotal, with no blocklist entries or trust score reductions recorded at this time. The page title explicitly impersonates a legitimate TRON/TRX conversion service to deceive visitors.

While the threat remains under investigation, security teams recommend avoiding transactions on this domain and monitoring for updates. Users who have interacted with tronbuy.org should revoke any exposed credentials, check wallet transactions for unauthorized transfers, and report the domain to their security provider or relevant cryptocurrency platform.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Page title: USDT to TRX Conversion & TRON Energy Purchase | Fast, Secure, Reliable

## Domain Intelligence
- Registered: 2026-04-04 03:34:50
- Registrar: Internet Domain Service BS Corp
- IP: 104.21.48.230

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/tronbuy.org
- PhishDestroy: https://phishdestroy.io/domain/tronbuy.org/
- LLM endpoint: https://phishdestroy.io/domain/tronbuy.org/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/tronbuy.org/
Last updated: 2026-04-04