# PhishDestroy domain threat record: trxify.info

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/trxify.info/
Machine-readable companion: https://phishdestroy.io/domain/trxify.info/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-27 16:37:48 UTC
- Last availability or vendor check: 2026-10-28 00:30:43 UTC
- Stored record updated: 2026-10-28 00:30:43 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: binance

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: Spaceship, Inc.
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a17e38-1657-765b-98a4-c18b72fbbfcf/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/trxify.info
- Certificate Transparency search: https://crt.sh/?q=%25.trxify.info
- Web Archive lookup: https://web.archive.org/web/*/https://trxify.info/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s automated assessment classified trxify.info as a crypto wallet drainer because the recorded page title claims the site offers “Rent & Buy TRX Energy at Institutional Rates” and asks visitors to connect a TRON wallet. The page title does not include a known timestamp. The domain was first seen by PhishDestroy on 2026-10-27 and returned an HTTP 200 response at that time.

How the scam works
Crypto wallet drainer schemes present a service—often framed as free tokens, fee reductions, or “energy”—and request the user to link or approve a cryptocurrency wallet. Once the user grants permission, the malicious contract can transfer assets or approve further transactions without additional user interaction, resulting in loss of funds.

Evidence
A VirusTotal scan on 2026-10-27 used 92 engines and reported zero malicious or suspicious detections. Google Safe Browsing checked the same day and did not flag the domain. urlscan.io captured the site on 2026-10-27; its engine flagged the page as malicious with a score of 98, though the overall verdict was non‑malicious. External blocklists MetaMask and SEAL listed the domain, PhishDestroy’s internal list also contains it, Spamhaus DBL marked it as phishing, and OTX recorded four pulses referencing the domain. The intake AI flagged the site as malicious based on the wallet‑connection prompt, but no page content was directly observed.

Infrastructure
The domain was registered on 2026-10-26 through Spaceship, Inc. DNS records at the time pointed to 188.114.96.3 and 188.114.97.3, IPs belonging to Cloudflare’s European network and recorded in GB. TLS was provided by Let’s Encrypt with a certificate valid from 2026-10-26 to 2027-01-24, and the site was protected by Cloudflare’s web application firewall.

What to do
Do not connect any wallet to trxify.info; if a connection or contract approval was granted, revoke the permission immediately and consider moving assets to a new wallet with a fresh seed phrase. Organizations should block the domain at DNS or proxy level, monitor outbound wallet‑related traffic, and add the domain to internal threat‑intelligence feeds.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17e38-1657-765b-98a4-c18b72fbbfcf/
Cloudflare Radar report: https://radar.cloudflare.com/scan/8b8566db-62c5-41a7-9399-6739cd2c1c62
URLQuery report: https://urlquery.net/report/4167443b-9b6c-426d-8eea-2c9fa9ad7130
Stored capture screenshot: https://i.ibb.co/CpK4T2Sh/5fdeec636c09.png
Cloudflare Radar screenshot (2026-10-27T17:10:56Z): https://screenshots.phishdestroy.io/cf/8b8566db-62c5-41a7-9399-6739cd2c1c62.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/4167443b-9b6c-426d-8eea-2c9fa9ad7130.png
VirusTotal report: https://www.virustotal.com/gui/domain/trxify.info
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=trxify.info
Archived copy: https://web.archive.org/web/20261027163942/https://trxify.info/
Revoke token approvals: https://revoke.cash/
Report crypto fraud (Chainabuse): https://www.chainabuse.com/report
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 20:14:40 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/CpK4T2Sh/5fdeec636c09.png
  Captured: 2026-10-27 16:37:48 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a17e38-1657-765b-98a4-c18b72fbbfcf.png
  Captured: 2026-10-27 16:37:48 UTC
  Source report: https://urlscan.io/result/01a17e38-1657-765b-98a4-c18b72fbbfcf/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/8b8566db-62c5-41a7-9399-6739cd2c1c62.png
  Captured: 2026-10-27 17:10:56 UTC
  Source report: https://radar.cloudflare.com/scan/8b8566db-62c5-41a7-9399-6739cd2c1c62
  SHA-256: 5a67a5c5f99ba4a6284e594fb7ab88216b4dddbc980dfbad97a05735f8f88803
- URLQuery: https://screenshots.phishdestroy.io/uq/4167443b-9b6c-426d-8eea-2c9fa9ad7130.png
  Source report: https://urlquery.net/report/4167443b-9b6c-426d-8eea-2c9fa9ad7130
  SHA-256: 730f1061829526b955cb97458bacb67fa2fd71df48e5c15a91f789bbe69d7b6a

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T17:12:20Z",
        "uuid": "01a17e38-1657-765b-98a4-c18b72fbbfcf",
        "scanned_at": "2026-10-27T16:36:13Z",
        "final_url": "https://trxify.info/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://trxify.info/",
                "from": "http://trxify.info/",
                "status": 307
            }
        ],
        "ip": "188.114.97.3",
        "domains": [
            "api.web3modal.com",
            "cdn.jsdelivr.net",
            "esm.sh",
            "fonts.gstatic.com",
            "cdnjs.cloudflare.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "104.18.28.72",
            "104.26.15.209",
            "142.251.14.94",
            "104.16.179.112",
            "104.17.24.14",
            "142.251.14.95",
            "188.114.97.3"
        ],
        "asns": [
            "13335",
            "15169"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "cc6ab82c69d70cb156e6b6dcc0951389aac43ec3382ff51294a1803469996183",
        "script_hashes": [
            "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8",
            "0577b2e4a1b31c6b3b9c55404e931855ca97b57e8810dbe204c497de955f226c",
            "15a3a29cb0a0347763dd5671d5694d6e0cddd17b13d1bdf3676c11481d01cd3b",
            "136a6f9724fcef1b7619857cfc4853161994e84afbcf8527f1b8a850eb466546"
        ],
        "globals": [
            "TRANSLATIONS",
            "__tp_toast",
            "PaIhtfl",
            "OSsaG_",
            "VRQ_ws",
            "tBFRoya",
            "tReRYsb",
            "b7cONUd",
            "cNUIYxC",
            "LDodl9",
            "oLY629",
            "qEhHrtQ",
            "U6Fmmv2",
            "fWPlghG",
            "cj5tN3e",
            "vWwmmLw",
            "IB63fqq",
            "kFtIrjf",
            "zYx_int",
            "CBLfUs",
            "R3H97HY",
            "X_b3ZCu",
            "FojDcNU",
            "ocAO5Ue",
            "zFAFQiT",
            "dzdFHN",
            "iiw5w7",
            "SD2gBS5",
            "JLAOMQV",
            "Ze1dkgs",
            "Cap",
            "CAP_CUSTOM_FETCH",
            "CAP_SILENT",
            "jh7ULn",
            "aA93GrA",
            "lkELxK",
            "jpEABf"
        ],
        "storage_keys": [
            "tp_theme"
        ],
        "tls": {
            "san": [
                "*.trxify.info",
                "trxify.info"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "trxify.info",
            "protocol": "QUIC",
            "valid_to": "2027-01-24T14:33:24Z",
            "valid_from": "2026-10-26T14:33:25Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 82,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html",
            "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
            "content-security-policy": "frame-ancestors http: https:",
            "x-content-type-options": "nosniff"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T17:12:23Z",
        "uuid": "8b8566db-62c5-41a7-9399-6739cd2c1c62",
        "scanned_at": "2026-10-27T17:10:56Z",
        "final_url": "https://trxify.info/",
        "status": 200,
        "history": [
            {
                "url": "https://trxify.info/",
                "status": 200
            }
        ],
        "dom_hash": "723d94926afa837d42cf989d4b4fd57d6dc353c50b8428458b8ae1d61f6f5f4c",
        "doc_hash": "eea5a3de00ebf81bee2b9d7aaba2583fcde3e6829d0419a2b576eba73d56448c",
        "domain_risks": [
            "New Domains",
            "Security Risks",
            "Newly Seen Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "trxify.info",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "trxify.info",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "trxify.info",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            },
            {
                "name": "trxify.info",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.31"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T20:10:11Z",
        "analysis_at": "2026-10-27T06:23:45Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 39
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "first_seen": "2026-10-26T15:39:47Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.183.96"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "matt.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::ac43:b760"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ara.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.18.213"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::6815:12d5"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "ara.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-27T06:24:06Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.trxify.info",
                "trxify.info"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "6ad0ecb6cc021a40882c350e48f39eab45f",
            "sha256": "127c214a8581ca7d069003590a1244eed067fa233ca224ce24e50c66a5db5195",
            "subject": "trxify.info",
            "valid_to": "2027-01-24T14:33:24Z",
            "valid_from": "2026-10-26T14:33:25Z"
        },
        "rdap": {
            "status": [
                "client transfer prohibited",
                "add period"
            ],
            "events": {
                "last changed": "2026-10-26T15:16:50Z",
                "registration": "2026-10-26T13:32:29Z",
                "registrar expiration": "2027-10-26T13:32:29Z",
                "last update of RDAP database": "2026-10-26T15:39:37Z"
            },
            "registrar": "Spaceship, Inc.",
            "registrar_iana_id": "3862"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T17:12:44Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "trxify.info"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-27T16:39:42Z",
            "first": "2026-10-27T16:39:42Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 11682
        },
        "social_tags": {
            "title": "TRXify — Rent & Buy TRX Energy at Institutional Rates",
            "themeColor": "#0a0a0d",
            "description": "TRXify delivers TRX Energy to your wallet in seconds. Save up to 78% on USDT transfer fees. Trusted by 128,000+ traders worldwide."
        },
        "trackers": {
            "requests": 13,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 3
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 3
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 3,
                "tls": 35,
                "wait": 143,
                "connect": 13,
                "download": 4
            },
            "response_ms": 198
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 47202,
            "co2_grams": 0.0017,
            "cleaner_than": 38
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "173.245.59.131",
                    "host": "matt.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.58.67",
                    "host": "ara.ns.cloudflare.com"
                }
            ],
            "zone": "trxify.info"
        },
        "location": {
            "ip": "2a06:98c1:3121::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "trxify.info"
        },
        "dns": {
            "A": [
                "188.114.96.3",
                "188.114.97.3"
            ],
            "NS": [
                "matt.ns.cloudflare.com",
                "ara.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"ara.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418531573, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3120::3",
                "2a06:98c1:3121::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=63072000; includeSubDomains; preload",
            "message": "Site is compatible with the HSTS preload list!",
            "compatible": true
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": "1; mode=block",
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": "frame-ancestors http: https:",
            "strictTransportPolicy": "max-age=63072000; includeSubDomains; preload",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3120::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://trxify.info"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Unpkg",
                "jsDelivr",
                "Google Font API",
                "Font Awesome",
                "cdnjs",
                "HSTS",
                "Cloudflare",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "internal_count": 8
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html",
                "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
                "content-security-policy": "frame-ancestors http: https:",
                "x-content-type-options": "nosniff"
            }
        }
    }
}
```