trx-checks[.]com

The domain trx-checks.com is currently listed as offline but remains flagged as a malicious infrastructure element. Registration data show the domain was created on 21 February 2026 through Dynadot LLC, with authoritative name servers ns1.dyna-ns.net and ns2.dyna-ns.net. DNS resolution points to the IPv4 address 172.86.67.69, which is geolocated to Germany and is associated with the hosting provider FranTech Solutions. The page title returned from the live host before takedown was simply "trx-checks.com", offering no additional context about the intended victim or service.

Threat intelligence sources confirm the site was used for a crypto‑related phishing campaign. AlienVault OTX includes the domain in 13 separate threat pulses, indicating repeated observation across multiple investigations. VirusTotal analysis recorded 16 detections out of 93 scanned security vendors, reinforcing the malicious classification. The domain also appears on a single public blocklist and is actively blocked by the PhishDestroy filtering service.

Given the combination of recent registration, dedicated hosting, and multiple independent detections, defenders should treat any traffic to trx-checks.com as hostile. Network security teams are advised to add the IPv4 address 172.86.67.69 to deny lists, enforce DNS sinkholing for the domain, and monitor for any residual artifacts that may reference the same registrar or name‑server pair. Incident response playbooks should consider the crypto‑scam vector when investigating compromised credentials or unauthorized cryptocurrency transactions. Continuous re‑evaluation is recommended, as the domain may be re‑registered or repurposed after the current offline status.