trxbuyer[.]org

Analysis of trxbuyer.org indicates a newly registered (December 13, 2025) domain used for a wallet/seed phishing campaign that impersonates the Discord brand. The site was hosted on Cloudflare infrastructure (AS13335) and resolved to IP address 188.114.97.3, a location in the United States. DNS is served by lynn.ns.cloudflare.com and raquel.ns.cloudflare.com, and the registrar is Tucows Domains Inc. No SSL certificate was observed, and the current HTTP status is offline, consistent with the “taken offline” note in the intelligence. The page title retrieved before takedown reads “Trxbuyer - Buy TRON Energy, Rent TRX Energy, Swap TRX USDT | Save 90%”, indicating a cryptocurrency‑focused lure that diverges from the claimed Discord impersonation, suggesting a multi‑vector social engineering approach.

Security telemetry shows mixed detection: nine of ninety‑five VirusTotal scanners flagged the domain, Gridinsoft assigned a trust score of 0 / 100, and PhishDestroy has blocked the host. It appears on a single security blocklist, but broader threat‑intel feeds (e.g., OTX or Google Safe Browsing) have not been cited. Defenders should prioritize updating domain blocklists with the exact FQDN, monitor Cloudflare‑associated IP ranges for related activity, and enforce strict outbound filtering for any traffic to the resolved IP.

Email gateways and endpoint protection should be tuned to detect Discord‑related credential‑phishing patterns, especially those that reference cryptocurrency incentives. Since the site is offline, threat actors may re‑host the payload on new domains; continuous watch of newly registered domains that share the “trxbuyer” string or similar brand‑impersonation cues is recommended. Incident response teams should also verify that no credential or seed data has been exfiltrated from users who may have interacted with the domain before takedown.