trx[.]im

PhishDestroy identifies the domain trx.im as a generic phishing threat, with an elevated risk level. This domain is now offline, but it was likely used as a crypto drainer or a fake login page to steal sensitive information. No specific brand was impersonated, but the generic nature of the threat suggests it could have targeted cryptocurrency users or other online services.

Threat intelligence reveals that trx.im was flagged by 3 of 95 VirusTotal security vendors, indicating a moderate detection rate. The domain was registered on April 18, 2026, and resolved to the IP address 13.248.169.48. Its SSL certificate was issued by GoDaddy.com, Inc. through the Go Daddy Secure Certificate Authority - G2. The domain appeared on one security blocklist and was found in one threat intelligence pulse from AlienVault OTX. These indicators collectively point to a domain that was set up with malicious intent, likely to harvest credentials or deploy crypto-draining scripts.

As the domain has been taken offline, the immediate risk is mitigated, but PhishDestroy urges users to remain vigilant. If you encountered trx.im in an email or message, do not attempt to visit it. Always verify links through PhishDestroy's database before interacting. For any cryptocurrency wallets or accounts that may have been exposed, immediately change passwords and enable two-factor authentication. Report any suspicious emails to your security team or to PhishDestroy for further analysis.