# trx-gas-saver.live — MALICIOUS

> trx-gas-saver.live is identified as a high-risk phishing domain. Avoid interaction and ensure your security tools are updated to stay protected.

## Summary
PhishDestroy classifies trx-gas-saver.live as a high-risk domain associated with generic phishing activities. This classification is based on multiple intelligence sources indicating malicious intent aimed at deceiving users.

Supporting evidence includes the domain's creation date in February 2026, its registration via Spaceship, Inc., and resolution to IP 188.114.96.3. VirusTotal detected malicious flags from 16 out of 95 security vendors, and the domain appears on at least one security blocklist. Additionally, it was noted within an AlienVault OTX threat pulse, reinforcing its dangerous profile. The domain’s page title was flagged as a suspected phishing site by Cloudflare before being taken offline.

To mitigate risk, users should avoid visiting trx-gas-saver.live or interacting with any related links. Security teams are advised to update blocklists and monitor for any resurgence or related infrastructure. Currently, the domain has been taken offline, reducing immediate risk, but vigilance remains essential to prevent exposure to similar threats.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Spaceship, Inc.
- Country: US
- IP: 188.114.96.3
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["sid.ns.cloudflare.com", "lilyana.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 16 vendors flagged
  Vendors: ["alphaMountain.ai", "BitDefender", "Certego", "CRDF", "CyRadar", "ESET", "Fortinet", "G-Data", "Gridinsoft", "Kaspersky", "Lionic", "Seclookup", "SOCRadar", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cb014-62cc-74eb-9f2e-e317504e06a9.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/6de1374c-d8f5-43f9-8acf-c85f51a57504
- PhishDestroy: https://phishdestroy.io/domain/trx-gas-saver.live/
- LLM endpoint: https://phishdestroy.io/domain/trx-gas-saver.live/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/trx-gas-saver.live/
Last updated: 2026-03-19