trxexx-cn[.]pages[.]dev

The domain trxexx-cn.pages.dev is currently under investigation for cryptocurrency phishing activity targeting users of TRON (TRX) and USDT services. Analysis indicates the site impersonates legitimate TRON energy purchase and token conversion platforms, presenting itself as a fast and secure service to deceive victims into disclosing wallet credentials or transferring funds. The domain remains active and has not yet been widely flagged by security vendors, suggesting an early-stage or targeted campaign. Infrastructure analysis reveals the domain was registered on April 06, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, geolocated to a hosting provider in Canada. At the time of assessment, the domain has received 0 detections out of 95 vendors on VirusTotal, indicating minimal prior exposure or evasion of automated detection systems. It appears on a single security blocklist, having been flagged by PhishDestroy. The site employs an SSL certificate issued by Google Trust Services (WE1), which may lend a false sense of legitimacy to unsuspecting users. The page title, 'trxexx | USDT to TRX Conversion & TRON Energy Purchase | Fast, Secure, Reliable,' directly mimics the branding and service offerings of legitimate cryptocurrency platforms. The current risk assessment categorizes this domain as active and under investigation, with potential for financial fraud and credential theft. Users are advised to avoid interacting with the site and to verify the authenticity of any cryptocurrency service through official channels. Network defenders should consider blocking the domain and associated IP address (188.114.96.3) at the perimeter. Cryptocurrency wallet providers and exchanges are encouraged to monitor for transactions linked to this domain and to educate users on recognizing phishing attempts targeting TRON and USDT services. Further monitoring is recommended to track the evolution of this campaign and its infrastructure.