how-to-buy-trx[.]hovode3078[.]workers[.]dev

The domain how-to-buy-trx.hovode3078.workers.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge IP 104.21.86.95, which is associated with ASN 13335 and geolocated in the United States. The site employed HSTS, Cloudflare services, and HTTP/3, and presented a TLS certificate issued by Google Trust Services under the WE1 label. An HTTP request returned a 403 status code, indicating that the server is currently refusing access. The page title observed during the brief crawl was "USDT to TRX Swap & TRON Energy Rental | Fast, Secure, Reliable," which explicitly references the TRON brand and suggests a cryptocurrency‑related service.

The domain is listed on a single security blocklist and has been blocked by PhishDestroy. Independent scoring from Gridinsoft assigned a trust score of 0 out of 100, reflecting a very low confidence in legitimacy. VirusTotal analysis shows that the domain was examined by 95 scanning engines, none of which reported a detection; however, the absence of detections does not confirm safety and should be interpreted as inconclusive.

The domain is currently marked offline, but its recent creation date, association with a reputable CDN, and explicit brand reference indicate a deliberate attempt to impersonate TRON for potential fraud or credential harvesting. Defenders should proactively block the domain at perimeter and DNS layers, monitor for any future resolution changes, and consider adding it to internal threat intelligence feeds. Continuous observation of the hosting provider’s abuse channels is advised, as the infrastructure could be repurposed for further malicious campaigns.