trxstaking[.]io

The domain trxstaking.io is currently active and has been classified as a high‑risk staking scam. It was registered on February 21, 2026 through Global Domain Group LLC. Automated scans observed an HTTP 403 response, and the TLS certificate is issued by Google Trust Services under the WE1 authority, indicating a valid‑looking HTTPS endpoint. Infrastructure analysis shows the domain resolves to IP address 172.67.187.98, which belongs to the Cloudflare network (ASN 13335). The DNS configuration uses the Cloudflare nameservers ada.ns.cloudflare.com and rodney.ns.cloudflare.com, and the site employs Cloudflare Browser Insights and HTTP/3, confirming that traffic is proxied through Cloudflare’s edge. Threat intelligence sources report that the page title returned by the server is “Nur einen Moment…”, a German phrase meaning “Just a moment…”. The observed behavior aligns with the listed scam type of a staking scam, where victims are typically prompted to deposit cryptocurrency for promised returns. The domain appears on three security blocklists and has been flagged by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows five out of ninety‑five scanners flag the domain, further supporting malicious intent. Defenders should block outbound connections to trxstaking.io at the network perimeter and add the domain to endpoint allow‑list exclusions. Continuous monitoring of DNS queries for the associated IP and the Cloudflare nameservers is advised, as the infrastructure can be leveraged for additional malicious sites. Incident response teams should treat any credential or crypto‑wallet data submitted to this domain as compromised and advise affected users to revoke access tokens and move assets to secure wallets.